<!DOCTYPE html><html lang="zh-CN" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=no"><title>docker容器网络 | 如是的学习博客</title><meta name="keywords" content="docker"><meta name="author" content="rushiy"><meta name="copyright" content="rushiy"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta name="description" content="Docker使用Linux桥接，在宿主机虚拟一个Docker容器网桥(docker0)，Docker启动一个容器时会根据Docker网桥的网段分配给容器一个IP地址，称为Container IP，同时Docker网桥是每个容器的默认网关。因为在同一宿主机内的容器都接入同一个网桥，这样容器之间就能够通过容器的Container IP直接通信。 Docker网桥是宿主机虚拟出来的，并不是真实存在的网络">
<meta property="og:type" content="article">
<meta property="og:title" content="docker容器网络">
<meta property="og:url" content="https://rushiy.gitee.io/docker/docker%E5%AE%B9%E5%99%A8%E7%BD%91%E7%BB%9C/index.html">
<meta property="og:site_name" content="如是的学习博客">
<meta property="og:description" content="Docker使用Linux桥接，在宿主机虚拟一个Docker容器网桥(docker0)，Docker启动一个容器时会根据Docker网桥的网段分配给容器一个IP地址，称为Container IP，同时Docker网桥是每个容器的默认网关。因为在同一宿主机内的容器都接入同一个网桥，这样容器之间就能够通过容器的Container IP直接通信。 Docker网桥是宿主机虚拟出来的，并不是真实存在的网络">
<meta property="og:locale" content="zh_CN">
<meta property="article:published_time" content="2022-09-24T06:54:14.000Z">
<meta property="article:author" content="rushiy">
<meta property="article:tag" content="docker">
<meta name="twitter:card" content="summary"><link rel="shortcut icon" href="/img/favicon.jpg"><link rel="canonical" href="https://rushiy.gitee.io/docker/docker%E5%AE%B9%E5%99%A8%E7%BD%91%E7%BB%9C/"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/css/index.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free/css/all.min.css" media="print" onload="this.media='all'"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.min.css" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = { 
  root: '/',
  algolia: undefined,
  localSearch: undefined,
  translate: undefined,
  noticeOutdate: undefined,
  highlight: {"plugin":"highlighjs","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false},
  copy: {
    success: '复制成功',
    error: '复制错误',
    noSupport: '浏览器不支持'
  },
  relativeDate: {
    homepage: false,
    post: false
  },
  runtime: '',
  date_suffix: {
    just: '刚刚',
    min: '分钟前',
    hour: '小时前',
    day: '天前',
    month: '个月前'
  },
  copyright: undefined,
  lightbox: 'fancybox',
  Snackbar: undefined,
  source: {
    justifiedGallery: {
      js: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery/dist/fjGallery.min.js',
      css: 'https://cdn.jsdelivr.net/npm/flickr-justified-gallery/dist/fjGallery.min.css'
    }
  },
  isPhotoFigcaption: false,
  islazyload: false,
  isAnchor: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
  title: 'docker容器网络',
  isPost: true,
  isHome: false,
  isHighlightShrink: false,
  isToc: true,
  postUpdate: '2022-11-19 01:18:40'
}</script><noscript><style type="text/css">
  #nav {
    opacity: 1
  }
  .justified-gallery img {
    opacity: 1
  }

  #recent-posts time,
  #post-meta time {
    display: inline !important
  }
</style></noscript><script>(win=>{
    win.saveToLocal = {
      set: function setWithExpiry(key, value, ttl) {
        if (ttl === 0) return
        const now = new Date()
        const expiryDay = ttl * 86400000
        const item = {
          value: value,
          expiry: now.getTime() + expiryDay,
        }
        localStorage.setItem(key, JSON.stringify(item))
      },

      get: function getWithExpiry(key) {
        const itemStr = localStorage.getItem(key)

        if (!itemStr) {
          return undefined
        }
        const item = JSON.parse(itemStr)
        const now = new Date()

        if (now.getTime() > item.expiry) {
          localStorage.removeItem(key)
          return undefined
        }
        return item.value
      }
    }
  
    win.getScript = url => new Promise((resolve, reject) => {
      const script = document.createElement('script')
      script.src = url
      script.async = true
      script.onerror = reject
      script.onload = script.onreadystatechange = function() {
        const loadState = this.readyState
        if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
        script.onload = script.onreadystatechange = null
        resolve()
      }
      document.head.appendChild(script)
    })
  
      win.activateDarkMode = function () {
        document.documentElement.setAttribute('data-theme', 'dark')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
        }
      }
      win.activateLightMode = function () {
        document.documentElement.setAttribute('data-theme', 'light')
        if (document.querySelector('meta[name="theme-color"]') !== null) {
          document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
        }
      }
      const t = saveToLocal.get('theme')
    
          if (t === 'dark') activateDarkMode()
          else if (t === 'light') activateLightMode()
        
      const asideStatus = saveToLocal.get('aside-status')
      if (asideStatus !== undefined) {
        if (asideStatus === 'hide') {
          document.documentElement.classList.add('hide-aside')
        } else {
          document.documentElement.classList.remove('hide-aside')
        }
      }
    
    const detectApple = () => {
      if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
        document.documentElement.classList.add('apple')
      }
    }
    detectApple()
    })(window)</script><meta name="generator" content="Hexo 6.3.0"></head><body><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="/img/favicon.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="sidebar-site-data site-data is-center"><a href="/archives/"><div class="headline">文章</div><div class="length-num">28</div></a><a href="/tags/"><div class="headline">标签</div><div class="length-num">3</div></a><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div><hr/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div></div></div></div><div class="post" id="body-wrap"><header class="post-bg" id="page-header" style="background-image: url('')"><nav id="nav"><span id="blog_name"><a id="site-name" href="/">如是的学习博客</a></span><div id="menus"><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> 首页</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> 时间轴</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> 标签</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> 关于</span></a></div></div><div id="toggle-menu"><a class="site-page"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="post-info"><h1 class="post-title">docker容器网络</h1><div id="post-meta"><div class="meta-firstline"><span class="post-meta-date"><i class="far fa-calendar-alt fa-fw post-meta-icon"></i><span class="post-meta-label">发表于</span><time class="post-meta-date-created" datetime="2022-09-24T06:54:14.000Z" title="发表于 2022-09-24 14:54:14">2022-09-24</time><span class="post-meta-separator">|</span><i class="fas fa-history fa-fw post-meta-icon"></i><span class="post-meta-label">更新于</span><time class="post-meta-date-updated" datetime="2022-11-18T17:18:40.877Z" title="更新于 2022-11-19 01:18:40">2022-11-19</time></span></div><div class="meta-secondline"><span class="post-meta-separator">|</span><span class="post-meta-pv-cv" id="" data-flag-title="docker容器网络"><i class="far fa-eye fa-fw post-meta-icon"></i><span class="post-meta-label">阅读量:</span><span id="busuanzi_value_page_pv"><i class="fa-solid fa-spinner fa-spin"></i></span></span></div></div></div></header><main class="layout" id="content-inner"><div id="post"><article class="post-content" id="article-container"><p>Docker使用Linux桥接，在宿主机虚拟一个<strong>Docker容器网桥(docker0)<strong>，</strong>Docker启动一个容器时会根据Docker网桥的网段分配给容器一个IP地址，称为<code>Container IP</code>，同时Docker网桥是每个容器的默认网关</strong>。因为在同一宿主机内的容器都接入同一个网桥，这样容器之间就能够通过容器的<code>Container IP</code>直接通信。</p>
<p><strong>Docker网桥是宿主机虚拟出来的，并不是真实存在的网络设备，外部网络是无法寻址到的，这也意味着外部网络无法通过<code>Container-IP</code>直接访问到容器</strong>。如果容器希望被外部访问，可以通过映射容器端口到宿主主机（端口映射），即<code>docker run</code>创建容器时候通过 <code>-p </code>或<code>-P</code>参数来启用，访问容器的时候就通过<code>[宿主机IP]:[容器端口]</code>访问容器。</p>
<p>查看<code>docker network</code>相关命令</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network <span class="built_in">ls</span></span></span><br><span class="line">NETWORK ID          NAME                DRIVER              SCOPE</span><br><span class="line">ad1f746530ad        bridge              bridge              local  # 桥接模式，默认</span><br><span class="line">86c30ec76685        host                host                local  # 开放式容器模式</span><br><span class="line">c2385d5ccbf9        none                null                local  # 封闭式容器模式</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network --<span class="built_in">help</span></span></span><br><span class="line">Usage:	docker network COMMAND</span><br><span class="line">Manage networks</span><br><span class="line">Commands:</span><br><span class="line">  connect     Connect a container to a network</span><br><span class="line">  create      Create a network</span><br><span class="line">  disconnect  Disconnect a container from a network</span><br><span class="line">  inspect     Display detailed information on one or more networks</span><br><span class="line">  ls          List networks</span><br><span class="line">  prune       Remove all unused networks</span><br><span class="line">  rm          Remove one or more networks</span><br><span class="line"></span><br><span class="line">Run &#x27;docker network COMMAND --help&#x27; for more information on a command.</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network inspect bridge   <span class="comment"># 查看容器网络的详细信息</span></span></span><br></pre></td></tr></table></figure>

<h2 id="四类网络模式"><a href="#四类网络模式" class="headerlink" title="四类网络模式"></a>四类网络模式</h2><p>docker默认拥有如下四种网络模式：</p>
<table>
<thead>
<tr>
<th>Docker网络模式</th>
<th>配置</th>
<th>说明</th>
</tr>
</thead>
<tbody><tr>
<td>host模式(开放式容器)</td>
<td><code>--net=host</code></td>
<td>容器和宿主机共享<code>Network namespace</code>。</td>
</tr>
<tr>
<td>container模式(联盟式容器)</td>
<td><code>--net=container:NAME/ID</code></td>
<td>容器和另外一个容器共享<code>Network namespace</code>，使用同一块网卡，各容器相互间可以使用lo进行同信。<code>kubernetes</code>中的<code>pod</code>就是多个容器共享一个<code>Network namespace</code>。</td>
</tr>
<tr>
<td>none模式(封闭式容器)</td>
<td><code>--net=none</code></td>
<td>容器有独立的<code>Network namespace</code>，但并没有对其进行任何网络设置，如分配veth pair和网桥连接，配置IP等，即网络孤岛，没有网络流量进出。</td>
</tr>
<tr>
<td>bridge模式(桥接式容器)</td>
<td><code>--net=bridge</code></td>
<td>拥有一个lo回环网卡和私有网络接口，默认模式</td>
</tr>
</tbody></table>
<p>如下图所示：</p>
<p><img src="/pic/docker-pic/image-20200717153037880.png" alt="image-20200717153037880"></p>
<h3 id="host模式"><a href="#host模式" class="headerlink" title="host模式"></a>host模式</h3><p>如果启动容器的时候使用<strong>host模式</strong>，那么这个容器将不会获得一个独立的<code>Network Namespace</code>，而是<strong>和宿主机共用一个Network Namespace</strong>。容器将不会虚拟出自己的网卡，配置自己的IP等，而是<strong>使用宿主机的IP、端口和主机名等</strong>。但是，容器的其他方面，如文件系统、进程列表等还是和宿主机隔离的。</p>
<p>使用host模式的容器可以直接使用宿主机的IP地址与外界通信，容器内部的服务端口也可以使用宿主机的端口，不需要进行NAT，<strong>host最大的优势就是网络性能比较好，但是docker host上已经使用的端口就不能再用了，网络的隔离性不好</strong>。</p>
<p>Host模式如下图所示：</p>
<img src="/pic/docker-pic/image-20200717140502390.png" alt="image-20200717140502390" style="zoom:67%;" />

<center>Host模式</center>

<p>我们以host模式启动一个容器</p>
<blockquote>
<p>如何区分当前是在容器内还是在宿主机内：</p>
<ul>
<li>可以通过敲docker命令区分，宿主机有该命令，容器无该命令</li>
<li>宿主机的当前目录为&#x2F;root–&gt;[root@docker ~]#，而容器的当前目录是&#x2F;–&gt;[root@docker &#x2F;]#</li>
</ul>
</blockquote>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker image <span class="built_in">ls</span></span> </span><br><span class="line">REPOSITORY     TAG       IMAGE ID        CREATED       SIZE</span><br><span class="line">scaven/nginx   1.2       0901fa9da894    6 days ago    132MB</span><br><span class="line">ubuntu         15.10     9b9cb95443b5    3 years ago   137MB</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker  run -d --name web_n1 --net=host 0901fa9da894</span></span><br><span class="line">06b4c8ad24f39b5e5ca1595b66eaf2227eb4fb994460f5697fa35d876fae5576</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container inspect 06b4c8ad24f3</span></span><br><span class="line">····</span><br><span class="line">            &quot;Networks&quot;: &#123;</span><br><span class="line">                &quot;host&quot;: &#123;</span><br><span class="line">                    &quot;IPAMConfig&quot;: null,</span><br><span class="line">                    &quot;Links&quot;: null,</span><br><span class="line">                    &quot;Aliases&quot;: null,</span><br><span class="line">                    &quot;NetworkID&quot;: &quot;86c30ec766859f24472ff5508cf08cbd5924a38b954e823f4e46da6c41fb2cb8&quot;,</span><br><span class="line">                    &quot;EndpointID&quot;: &quot;d21e11627b5a1bd4a7e96ba8c0b4bcbd01aa1fce8517742464e6e96545a019bc&quot;,</span><br><span class="line">                    &quot;Gateway&quot;: &quot;&quot;,    # 未显示网关地址</span><br><span class="line">                    &quot;IPAddress&quot;: &quot;&quot;,  # 未显示IP地址</span><br><span class="line">                    &quot;IPPrefixLen&quot;: 0,</span><br><span class="line">                    &quot;IPv6Gateway&quot;: &quot;&quot;,</span><br><span class="line">                    &quot;GlobalIPv6Address&quot;: &quot;&quot;,</span><br><span class="line">                    &quot;GlobalIPv6PrefixLen&quot;: 0,</span><br><span class="line">                    &quot;MacAddress&quot;: &quot;&quot;,</span><br><span class="line">                    &quot;DriverOpts&quot;: null</span><br><span class="line">                &#125;</span><br><span class="line">            &#125;</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker port 06b4c8ad24f3  <span class="comment"># 没有端口映射，即容器将使用宿主机的端口</span></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">查看物理机本地端口使用情况</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">netstat  -lntp  | grep 80 <span class="comment"># 本地的80端口被使用，如下</span></span></span><br><span class="line">Active Internet connections (only servers)</span><br><span class="line">Proto Recv-Q Send-Q Local Address  Foreign Address  State    PID/Program name </span><br><span class="line">tcp      0      0   0.0.0.0:80     0.0.0.0:*        LISTEN   19590/nginx: master # 占用宿主机端口80        </span><br><span class="line">tcp6     0      0  :::80           :::*             LISTEN   19590/nginx: master </span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a  <span class="comment"># 此处没有多出容器的IP地址，若此时进入容器06b4c8ad24f3内，看到的信息跟此处的信息一样</span></span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:64:2a:59 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.15/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::b6e4:fced:d3d3:35ee/64 scope link noprefixroute </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc noqueue state DOWN group default </span><br><span class="line">    link/ether 02:42:36:01:0b:3f brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">进入容器查看ip a的输出</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"> ip a  <span class="comment"># 跟在宿主机里面执行ip a得到的结果一样</span></span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:64:2a:59 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.15/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::b6e4:fced:d3d3:35ee/64 scope link noprefixroute </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc noqueue state DOWN group default </span><br><span class="line">    link/ether 02:42:36:01:0b:3f brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">我们直接访问nginx</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">curl -I 10.138.3.15:80  <span class="comment"># 使用宿主机IP地址和端口访问nginx</span></span></span><br><span class="line">HTTP/1.1 200 OK</span><br><span class="line">Server: nginx/1.19.1</span><br><span class="line">Date: Fri, 17 Jul 2020 06:18:20 GMT</span><br><span class="line">Content-Type: text/html</span><br><span class="line">Content-Length: 612</span><br><span class="line">Last-Modified: Tue, 07 Jul 2020 15:52:25 GMT</span><br><span class="line">Connection: keep-alive</span><br><span class="line">ETag: &quot;5f049a39-264&quot;</span><br><span class="line">Accept-Ranges: bytes</span><br></pre></td></tr></table></figure>

<p>下面，我们通过浏览器直接访问nginx访问：</p>
<p><img src="/pic/docker-pic/image-20200717142321013.png" alt="image-20200717142321013"></p>
<h3 id="container模式"><a href="#container模式" class="headerlink" title="container模式"></a>container模式</h3><p><strong>这个模式指定新创建的容器和已经存在的一个容器共享一个 <code>Network Namespace</code>，而不是和宿主机共享</strong>。<strong>新创建的容器不会创建自己的网卡，配置自己的 IP，而是和一个指定的容器共享 IP、主机名、端口范围等</strong>。同样，两个容器除了网络方面，其他的如文件系统、进程列表等还是隔离的。<strong>两个容器的进程可以通过 lo 网卡设备通信</strong>。</p>
<p>Container模式示意图：</p>
<img src="/pic/docker-pic/image-20200717142956583.png" alt="image-20200717142956583" style="zoom:67%;" />

<center>Container网络模式</center>

<p>案例展示：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -it --name centos7.6 --net=container:web_n1 f1cb7c7d58b7</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a    <span class="comment"># 请注意，这里我们已经进入了容器内，工作目录发生了变化</span></span></span><br><span class="line">bash: ip: command not found</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ifconfig</span>    </span><br><span class="line">bash: ifconfig: command not found</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">由于查看不到IP地址，因此我们先安装软件包</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">yum -y install net-tools</span>  </span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ifconfig   <span class="comment"># 由下可知，使用的仍然是主机的网络名称空间</span></span></span><br><span class="line">docker0: flags=4099&lt;UP,BROADCAST,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255</span><br><span class="line">        ether 02:42:36:01:0b:3f  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 0  bytes 0 (0.0 B)A</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 0  bytes 0 (0.0 B)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line"></span><br><span class="line">ens33: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 10.138.3.15  netmask 255.255.255.0  broadcast 10.138.3.255</span><br><span class="line">        inet6 fe80::b6e4:fced:d3d3:35ee  prefixlen 64  scopeid 0x20&lt;link&gt;</span><br><span class="line">        ether 00:0c:29:64:2a:59  txqueuelen 1000  (Ethernet)</span><br><span class="line">        RX packets 171689  bytes 239863139 (228.7 MiB)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 44482  bytes 3775713 (3.6 MiB)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line"></span><br><span class="line">lo: flags=73&lt;UP,LOOPBACK,RUNNING&gt;  mtu 65536</span><br><span class="line">        inet 127.0.0.1  netmask 255.0.0.0</span><br><span class="line">        inet6 ::1  prefixlen 128  scopeid 0x10&lt;host&gt;</span><br><span class="line">        loop  txqueuelen 1000  (Local Loopback)</span><br><span class="line">        RX packets 20  bytes 1700 (1.6 KiB)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 20  bytes 1700 (1.6 KiB)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br></pre></td></tr></table></figure>

<p>宿主机网络和centos7.6容器网络截图比较如下(容器web_n1由于只有nginx的最小运行环境，因此没有yum命令，也没有网络相关命令，因此此处就直接跟宿主机网络做比较了)：</p>
<p><img src="/pic/docker-pic/image-20200717145845698.png" alt="image-20200717145845698"></p>
<h3 id="none模式"><a href="#none模式" class="headerlink" title="none模式"></a>none模式</h3><p>使用<code>none</code>模式，Docker容器拥有自己的<code>Network Namespace</code>，但是，并不为Docker容器进行任何网络配置。也就是说，这个Docker容器没有网卡、IP、路由等信息。需要我们自己为Docker容器添加网卡、配置IP等。</p>
<p><strong>这种网络模式下容器只有lo回环网络，没有其他网卡</strong>。none模式可以在容器创建时通过<code>--network=none</code>来指定。<strong>这种类型的网络没有办法联网，封闭的网络能很好的保证容器的安全性，因此常用于不需要网络的情况下</strong>。</p>
<p>None模式示意图:</p>
<p><img src="/pic/docker-pic/image-20200717151140261.png" alt="image-20200717151140261"></p>
<center>None网络模式</center>

<h3 id="bridge模式-默认模式"><a href="#bridge模式-默认模式" class="headerlink" title="bridge模式(默认模式)"></a>bridge模式(默认模式)</h3><p>当Docker进程启动时，会在主机上创建一个名为<code>docker0</code>的虚拟网桥，此主机上启动的Docker容器会连接到这个虚拟网桥上。虚拟网桥的工作方式和物理交换机类似，这样主机上的所有容器就通过交换机连在了一个二层网络中。</p>
<p><strong>从docker0子网中分配一个IP给容器使用，并设置docker0的IP地址为容器的默认网关。在主机上创建一对虚拟网卡<code>veth pair</code>设备，Docker将<code>veth pair</code>设备的一端放在新创建的容器中，并命名为<code>eth0</code>（容器的网卡），另一端放在主机中，以<code>vethxxx</code>这样类似的名字命名，并将这个网络设备加入到<code>docker0</code>网桥中。可以通过<code>brctl show</code>命令查看</strong>。</p>
<p><strong>bridge模式是docker的默认网络模式</strong>，不写<code>--net</code>参数，就是<code>bridge</code>模式。使用<code>docker run -p</code>时，docker实际是在iptables做了DNAT规则，实现端口转发功能。可以使用<code>iptables -t nat -vnL</code>查看。</p>
<p>bridge模式如下图所示：</p>
<img src="/pic/docker-pic/image-20200717152228588.png" alt="image-20200717152228588" style="zoom:67%;" />

<center>Docker的网络实现</center>

<p>案例展示：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">rm</span> `docker container <span class="built_in">ls</span> -a -q`  <span class="comment"># 删除本地服务器上的所有容器</span></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">启动桥接式容器前宿主机上的网络信息如下</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a</span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:64:2a:59 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.15/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::b6e4:fced:d3d3:35ee/64 scope link noprefixroute </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc noqueue state DOWN group default </span><br><span class="line">    link/ether 02:42:36:01:0b:3f brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">以默认网络模式启动容器</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -d  --name web_n1 0901fa9da894</span>  </span><br><span class="line">fd963117694015a936e5cb3068b99642460c000f01e0a69b2715af5995700c1d</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">以默认网络模式启动容器后，物理机上会多出一个网卡</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a</span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:64:2a:59 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.15/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::b6e4:fced:d3d3:35ee/64 scope link noprefixroute </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default </span><br><span class="line">    link/ether 02:42:36:01:0b:3f brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:36ff:fe01:b3f/64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">7: vethadf4fe6@if6: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default </span><br><span class="line">    link/ether ba:76:a8:62:25:f5 brd ff:ff:ff:ff:ff:ff link-netnsid 0</span><br><span class="line">    inet6 fe80::b876:a8ff:fe62:25f5/64 scope link </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">此时容器对外网络是连通的，宿主机以外的外部网络不能访问容器，除非暴露端口，该宿主机上的容器可以相互访问</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ping 127.17.0.2</span></span><br><span class="line">PING 127.17.0.2 (127.17.0.2) 56(84) bytes of data.</span><br><span class="line">64 bytes from 127.17.0.2: icmp_seq=1 ttl=64 time=0.033 ms</span><br><span class="line">64 bytes from 127.17.0.2: icmp_seq=2 ttl=64 time=0.055 ms</span><br><span class="line">^C</span><br><span class="line">--- 127.17.0.2 ping statistics ---</span><br><span class="line">2 packets transmitted, 2 received, 0% packet loss, time 1001ms</span><br><span class="line">rtt min/avg/max/mdev = 0.033/0.044/0.055/0.011 ms</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">iptables -t nat -vnL</span></span><br><span class="line">Chain PREROUTING (policy ACCEPT 47 packets, 6015 bytes)</span><br><span class="line"> pkts bytes target     prot opt in     out     source          destination         </span><br><span class="line">    9   468 DOCKER     all  --  *      *       0.0.0.0/0       0.0.0.0/0      ADDRTYPE match dst-type LOCAL</span><br><span class="line"></span><br><span class="line">Chain INPUT (policy ACCEPT 47 packets, 6015 bytes)</span><br><span class="line"> pkts bytes target     prot opt in     out     source               destination   </span><br><span class="line"></span><br><span class="line">Chain OUTPUT (policy ACCEPT 84 packets, 5287 bytes)</span><br><span class="line"> pkts bytes target     prot opt in     out     source         destination         </span><br><span class="line">    2   120 DOCKER     all  --  *      *       0.0.0.0/0      !127.0.0.0/8   ADDRTYPE match dst-type LOCAL</span><br><span class="line"></span><br><span class="line">Chain POSTROUTING (policy ACCEPT 84 packets, 5287 bytes)  # 该命令展示结果如下图所示</span><br><span class="line"> pkts bytes target     prot opt in     out     source               destination         </span><br><span class="line">    0     0 MASQUERADE  all  --  *      !docker0  172.17.0.0/16        0.0.0.0/0   </span><br><span class="line"></span><br><span class="line">Chain DOCKER (2 references)</span><br><span class="line"> pkts bytes target     prot opt in     out     source               destination   </span><br><span class="line">    0     0 RETURN     all  --  docker0 *       0.0.0.0/0            0.0.0.0/0    </span><br></pre></td></tr></table></figure>

<p>​       上文iptables转发如下图所示：</p>
 <img src="/pic/docker-pic/image-20200717164244473.png" alt="image-20200717164244473" style="zoom:67%;" />

<ul>
<li>外网如何访问容器？通过端口映射以及选项指定映射端口</li>
<li>外网访问容器用到了<code>docker-proxy</code>和<code>iptables DNAT </code>，宿主机访问本机容器使用的是<code>iptables DNAT</code>，外部主机访问容器或容器之间的访问是<code>docker-proxy</code>实现</li>
</ul>
<h2 id="桥接模式下暴露端口"><a href="#桥接模式下暴露端口" class="headerlink" title="桥接模式下暴露端口"></a>桥接模式下暴露端口</h2><p><code>docker run [-p/-P]</code> ：为容器暴露的所有端口进行映射。</p>
<p><code>-P</code>：<strong>将容器内部开放的网络端口随机映射到宿主机的一个端口上</strong>。</p>
<p><code>-p</code>：<strong>指定要映射的端口，可以指定宿主机上的端口，容器的端口或两者都指定</strong>。</p>
<p>有四种方式：</p>
<ul>
<li><strong>ContainerPort</strong><br>  指定容器端口，宿主机端口随机映射：<code>docker run -p 80 -i -t IMAGE /bin/bash</code></li>
<li><strong>hostPort:Container:Port</strong><br>  同时指定宿主机和容器的端口：<code>docker run -p 8080:80 -i -t IMAGE /bin/bash</code></li>
<li><strong>ip::containerPort</strong><br>  指定宿主机网卡及容器端口：<code>docker run -p 0.0.0.0:80 -i -t IMAGE /bin/bash</code></li>
<li><strong>ip:hostPort:containerPort</strong><br>  指定宿主机网卡、端口和容器端口<code>docker run -p 0.0.0.0:8080:80 -i -t IMAGE /bin/bash</code></li>
</ul>
<h3 id="暴露随机端口"><a href="#暴露随机端口" class="headerlink" title="暴露随机端口"></a>暴露随机端口</h3><ul>
<li><code>-P</code>的使用方法：将容器内开放的端口随机映射到宿主机的高位端口上，通过访问宿主机的该端口就能访问到容器中的相应的服务。</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker images</span></span><br><span class="line">REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE</span><br><span class="line">scaven/nginx        1.2                 0901fa9da894        6 days ago          132MB</span><br><span class="line">centos              centos7.6.1810      f1cb7c7d58b7        16 months ago       202MB</span><br><span class="line">ubuntu              15.10               9b9cb95443b5        3 years ago         137MB</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -d -P --name web01  0901fa9da894   <span class="comment"># 启动容器</span></span></span><br><span class="line">3f1cbb448709d5d7a22e56c5b505ca1fcce972e7daf14e33a23a58125ae7bb18</span><br></pre></td></tr></table></figure>

<p>此时查看防火墙转发规则如下：</p>
<p><img src="/pic/docker-pic/image-20200717173433753.png" alt="image-20200717173433753"></p>
<p>由于已经暴露了端口，因此可以进行远程访问nginx服务：</p>
<p><img src="/pic/docker-pic/image-20200717173637134.png" alt="image-20200717173637134"></p>
<ul>
<li><code>-p</code>：使用<code>-p 容器端口</code>进行随机端口映射</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -d -p 80 --name web03  0901fa9da894</span></span><br><span class="line">6cdfd996b45cdddf670666f0697db57b500cbfa189646ab4910cdf485bf826e2</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker port 6cdfd996b45c</span></span><br><span class="line">80/tcp -&gt; 0.0.0.0:32769</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">iptables -t nat -vnL</span></span><br></pre></td></tr></table></figure>

<p>此时查看防火墙转发规则如下：</p>
<p><img src="/pic/docker-pic/image-20200717174757495.png" alt="image-20200717174757495"></p>
<p>主机上端口的使用情况：</p>
<p><img src="/pic/docker-pic/image-20200717175052992.png" alt="image-20200717175052992"></p>
<ul>
<li>-p：使用<code>-p ip::容器端口</code>进行随机端口映射</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -d -p 127.0.0.1::80 --name web04  0901fa9da894</span></span><br><span class="line">5a1d7105ef29a9ad9e4b31e05f2487427564beed1de185f378ad3223c53eeff9</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker port 5a1d7105ef29</span></span><br><span class="line">80/tcp -&gt; 127.0.0.1:32770</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">iptables -t nat -vnL</span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">由于是暴露了127.0.0.1:32700端口，因此只能本机访问</span></span><br></pre></td></tr></table></figure>

<p>此时查看防火墙转发规则和主机端口映射情况如下：</p>
<p><img src="/pic/docker-pic/image-20200717175511320.png" alt="image-20200717175511320"></p>
<h3 id="暴露指定端口"><a href="#暴露指定端口" class="headerlink" title="暴露指定端口"></a>暴露指定端口</h3><ul>
<li>-p：使用<code>-p 宿主机端口:容器端口</code>进行指定端口映射</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -d -p 8080:80 --name web02  0901fa9da894</span></span><br><span class="line">3a51900386cb2962e8bc52ba19e64fe8554bd29965b00170c426cfe87b6eab07</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker port 3a51900386cb</span></span><br><span class="line">80/tcp -&gt; 0.0.0.0:8080</span><br></pre></td></tr></table></figure>

<p>端口映射情况如下图所示：</p>
<p><img src="/pic/docker-pic/image-20200717174102237.png" alt="image-20200717174102237"></p>
<p>主机上端口的使用情况：</p>
<p><img src="/pic/docker-pic/image-20200717174304064.png" alt="image-20200717174304064"></p>
<ul>
<li>p：使用<code>-p 宿主机IP:宿主机端口:容器端口</code>进行指定端口映射</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -d -p 10.138.3.15:9999:80 --name web06  0901fa9da894</span></span><br><span class="line">95b7279dbe9d046b98e59c37ba222c76b727842c71bcb75b9dfca78f2852cd2f</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker port 95b7279dbe9d</span></span><br><span class="line">80/tcp -&gt; 10.138.3.15:9999</span><br></pre></td></tr></table></figure>

<p>防火墙转发规则如下：</p>
<p><img src="/pic/docker-pic/image-20200717180410967.png" alt="image-20200717180410967"></p>
<p>外部访问：</p>
<p><img src="/pic/docker-pic/image-20200717180202403.png" alt="image-20200717180202403"></p>
<h2 id="跨主机间的docker网络：macvlan"><a href="#跨主机间的docker网络：macvlan" class="headerlink" title="跨主机间的docker网络：macvlan"></a>跨主机间的docker网络：macvlan</h2><p><code>macvlan</code>可以实现两台主机上的容器相互访问（只能两台主机上的容器互通，与宿主机和外网均不通），做法是在两台宿主机上都新建macvlan类型的网络，macvlan等同于将在两台宿主机之间新建了一个用于容器通信的交换机。但有一个问题是：<code>host</code>和<code>container</code>是无法互通的，因为是macvlan的原因，同一个网口的流量是无法回传的，除非在外部有一个支持<code>VEPA</code>或者<code>VN-Link</code>的交换机。</p>
<h3 id="新建macvlan类型的网络"><a href="#新建macvlan类型的网络" class="headerlink" title="新建macvlan类型的网络"></a>新建macvlan类型的网络</h3><p>命令格式：<code>docker network create -d macvlan --subnet=10.0.0.0/24 --ip-range=10.0.0.32/28 --gateway=10.0.0.254 -o parent=ens33 macnet</code></p>
<p>参数：</p>
<ul>
<li><code>subnet</code>：子网</li>
<li><code>ip-range</code>：docker自动分配ip范围，防止和局域网内其他主机重复</li>
<li><code>gateway</code>：网关</li>
<li><code>parent</code>：父接口，也就是host主机的物理网卡</li>
<li><code>aux-address</code>：docker分配ip时排除的ip（这个ip有其他用途），格式为：<code>--aux-address=&quot;my-router=xx.xx.xx.xx&quot;</code></li>
</ul>
<p>在两台docker宿主机上执行下面的创建命令。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network create -d macvlan \</span></span><br><span class="line"><span class="language-bash">&gt;   --subnet=10.0.0.0/24 \</span></span><br><span class="line"><span class="language-bash">&gt;   --ip-range=10.0.0.32/28 \</span></span><br><span class="line"><span class="language-bash">&gt;   --gateway=10.0.0.254 \</span></span><br><span class="line"><span class="language-bash">&gt;   -o parent=ens33 macnet</span></span><br><span class="line"></span><br><span class="line">9968439d4ebf51cd10fc3ffb62930448cbfea5545ec8a8b8c1420c9b7d4ca731</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network <span class="built_in">ls</span>  | grep macnet</span></span><br><span class="line">9968439d4ebf   macnet    macvlan   local</span><br><span class="line"></span><br><span class="line">[root@VM-base ~]# docker network inspect macnet</span><br><span class="line">[</span><br><span class="line">    &#123;</span><br><span class="line">        &quot;Name&quot;: &quot;macnet&quot;,</span><br><span class="line">        &quot;Id&quot;: &quot;9968439d4ebf51cd10fc3ffb62930448cbfea5545ec8a8b8c1420c9b7d4ca731&quot;,</span><br><span class="line">        &quot;Created&quot;: &quot;2022-10-24T11:02:54.545360372+08:00&quot;,</span><br><span class="line">        &quot;Scope&quot;: &quot;local&quot;,</span><br><span class="line">        &quot;Driver&quot;: &quot;macvlan&quot;,</span><br><span class="line">        &quot;EnableIPv6&quot;: false,</span><br><span class="line">        &quot;IPAM&quot;: &#123;</span><br><span class="line">            &quot;Driver&quot;: &quot;default&quot;,</span><br><span class="line">            &quot;Options&quot;: &#123;&#125;,</span><br><span class="line">            &quot;Config&quot;: [</span><br><span class="line">                &#123;</span><br><span class="line">                    &quot;Subnet&quot;: &quot;10.0.0.0/24&quot;,</span><br><span class="line">                    &quot;IPRange&quot;: &quot;10.0.0.32/28&quot;,</span><br><span class="line">                    &quot;Gateway&quot;: &quot;10.0.0.254&quot;</span><br><span class="line">                &#125;</span><br><span class="line">            ]</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;Internal&quot;: false,</span><br><span class="line">        &quot;Attachable&quot;: false,</span><br><span class="line">        &quot;Ingress&quot;: false,</span><br><span class="line">        &quot;ConfigFrom&quot;: &#123;</span><br><span class="line">            &quot;Network&quot;: &quot;&quot;</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;ConfigOnly&quot;: false,</span><br><span class="line">        &quot;Containers&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Options&quot;: &#123;</span><br><span class="line">            &quot;parent&quot;: &quot;ens33&quot;</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;Labels&quot;: &#123;&#125;</span><br><span class="line">    &#125;</span><br><span class="line">]</span><br></pre></td></tr></table></figure>

<h3 id="使用macvlan类型网络创建的容器"><a href="#使用macvlan类型网络创建的容器" class="headerlink" title="使用macvlan类型网络创建的容器"></a>使用macvlan类型网络创建的容器</h3><p>（1）分别在两台宿主机上创建容器</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 删除宿主机上的所有容器</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">rm</span> -f `docker container <span class="built_in">ls</span> -a -q`</span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 宿主机1</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -it -d  --network macnet --ip=10.0.0.100 busybox:latest</span></span><br><span class="line">e590f7221f2dc33543f6e5dde1a88529224979a829294601627f807e69c93ab5</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 宿主机2</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -it -d  --network macnet --ip=10.0.0.101 busybox:latest</span></span><br><span class="line">61a848ea7ff156c9fbd83a6f3ca9521e32f46afe32a2c3f24ad35aedf9c28f55</span><br></pre></td></tr></table></figure>

<blockquote>
<p>需要使用–ip&#x3D;xx.xx.xx.xx指定容器IP地址。</p>
</blockquote>
<p>（2）查看两个容器的IP地址</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container inspect  e590f7221f2dc33543f | grep  IPAddress</span></span><br><span class="line">            &quot;SecondaryIPAddresses&quot;: null,</span><br><span class="line">            &quot;IPAddress&quot;: &quot;&quot;,</span><br><span class="line">                    &quot;IPAddress&quot;: &quot;10.0.0.100&quot;,</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container inspect  61a848ea7ff156c9fb | grep  IPAddress</span></span><br><span class="line">            &quot;SecondaryIPAddresses&quot;: null,</span><br><span class="line">            &quot;IPAddress&quot;: &quot;&quot;,</span><br><span class="line">                    &quot;IPAddress&quot;: &quot;10.0.0.101&quot;,</span><br></pre></td></tr></table></figure>

<p>（3）进入容器，检查网络连通性</p>
<ul>
<li>进入10.0.0.101</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it 61a848ea7ff1 /bin/sh</span></span><br><span class="line">/ # ip a</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">9: eth0@if2: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu 1500 qdisc noqueue</span><br><span class="line">    link/ether 02:42:0a:00:00:65 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.0.0.101/24 brd 10.0.0.255 scope global eth0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># ping容器10.0.0.100</span></span></span><br><span class="line">/ # ping 10.0.0.100 -c 4</span><br><span class="line">PING 10.0.0.100 (10.0.0.100): 56 data bytes</span><br><span class="line">64 bytes from 10.0.0.100: seq=0 ttl=64 time=1.313 ms</span><br><span class="line">64 bytes from 10.0.0.100: seq=1 ttl=64 time=4.184 ms</span><br><span class="line">64 bytes from 10.0.0.100: seq=2 ttl=64 time=1.280 ms</span><br><span class="line">64 bytes from 10.0.0.100: seq=3 ttl=64 time=1.378 ms</span><br><span class="line"></span><br><span class="line">--- 10.0.0.100 ping statistics ---</span><br><span class="line">4 packets transmitted, 4 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 1.280/2.038/4.184 ms</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># ping外网www.baidu.com</span></span></span><br><span class="line">/ # ping www.baidu.com -c 4</span><br><span class="line">ping: bad address &#x27;www.baidu.com&#x27;</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># ping宿主机</span></span></span><br><span class="line">/ # ping 10.138.3.131 -c 4</span><br><span class="line">PING 10.138.3.131 (10.138.3.131): 56 data bytes</span><br><span class="line"></span><br><span class="line">--- 10.138.3.131 ping statistics ---</span><br><span class="line">4 packets transmitted, 0 packets received, 100% packet loss</span><br></pre></td></tr></table></figure>

<ul>
<li>进入10.0.0.100</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it e590f7221f2d  /bin/sh</span></span><br><span class="line">/ # ip a</span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">6: eth0@if2: &lt;BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN&gt; mtu 1500 qdisc noqueue</span><br><span class="line">    link/ether 02:42:0a:00:00:64 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.0.0.100/24 brd 10.0.0.255 scope global eth0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># ping容器10.0.0.101</span></span></span><br><span class="line">/ # ping 10.0.0.101 -c 4</span><br><span class="line">PING 10.0.0.101 (10.0.0.101): 56 data bytes</span><br><span class="line">64 bytes from 10.0.0.101: seq=0 ttl=64 time=1.417 ms</span><br><span class="line">64 bytes from 10.0.0.101: seq=1 ttl=64 time=0.924 ms</span><br><span class="line">64 bytes from 10.0.0.101: seq=2 ttl=64 time=1.136 ms</span><br><span class="line">64 bytes from 10.0.0.101: seq=3 ttl=64 time=1.180 ms</span><br><span class="line"></span><br><span class="line">--- 10.0.0.101 ping statistics ---</span><br><span class="line">4 packets transmitted, 4 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 0.924/1.164/1.417 ms</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># ping宿主机</span></span></span><br><span class="line">/ # ping 10.138.3.130 -c 4</span><br><span class="line">PING 10.138.3.130 (10.138.3.130): 56 data bytes</span><br><span class="line"></span><br><span class="line">--- 10.138.3.130 ping statistics ---</span><br><span class="line">4 packets transmitted, 0 packets received, 100% packet loss</span><br></pre></td></tr></table></figure>

<h2 id="同一个项目中的容器通信的常规做法"><a href="#同一个项目中的容器通信的常规做法" class="headerlink" title="同一个项目中的容器通信的常规做法"></a>同一个项目中的容器通信的常规做法</h2><p>我们知道，容器的IP地址随着容器的启停会不断变化，那么在项目中通过IP地址定位容器的方式是不可取的，那么同一个项目中的多个容器之间应该如何进行通信呢？</p>
<p><strong>通常的做法是新建网桥，通过主机名识别相关联的项目容器</strong>。</p>
<p>在docker主机上新建一个网桥，可以通过主机名进行通信，<code>默认网桥只能通过ip地址通信</code>。下面通过在同一网段(两个不同网桥，默认网桥和新建网桥)下ping另一个容器的IP地址和主机名进行测试。</p>
<h3 id="默认网桥：可通过ip通信，不可通过主机名通信"><a href="#默认网桥：可通过ip通信，不可通过主机名通信" class="headerlink" title="默认网桥：可通过ip通信，不可通过主机名通信"></a>默认网桥：可通过ip通信，不可通过主机名通信</h3><p>使用默认网桥新建两个容器，分别在两个容器中通过IP地址和主机名进行ping测试。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">查看默认网桥bridge的详细信息</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network inspect bridge</span></span><br><span class="line">[</span><br><span class="line">    &#123;</span><br><span class="line">        &quot;Name&quot;: &quot;bridge&quot;,</span><br><span class="line">        &quot;Id&quot;: &quot;b3064d19f20d631d2a7f3c298a4ee6583a1544ae15c7966f61941d26954670ef&quot;,</span><br><span class="line">        &quot;Created&quot;: &quot;2021-04-01T10:59:13.315953055+08:00&quot;,</span><br><span class="line">        &quot;Scope&quot;: &quot;local&quot;,</span><br><span class="line">        &quot;Driver&quot;: &quot;bridge&quot;,</span><br><span class="line">        &quot;EnableIPv6&quot;: false,</span><br><span class="line">        &quot;IPAM&quot;: &#123;</span><br><span class="line">            &quot;Driver&quot;: &quot;default&quot;,</span><br><span class="line">            &quot;Options&quot;: null,</span><br><span class="line">            &quot;Config&quot;: [</span><br><span class="line">                &#123;</span><br><span class="line">                    &quot;Subnet&quot;: &quot;172.17.0.0/16&quot;,   # 默认网桥默认网段是172.17.0.0/16</span><br><span class="line">                    &quot;Gateway&quot;: &quot;172.17.0.1&quot;</span><br><span class="line">                &#125;</span><br><span class="line">            ]</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;Internal&quot;: false,</span><br><span class="line">        &quot;Attachable&quot;: false,</span><br><span class="line">        &quot;Ingress&quot;: false,</span><br><span class="line">        &quot;ConfigFrom&quot;: &#123;</span><br><span class="line">            &quot;Network&quot;: &quot;&quot;</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;ConfigOnly&quot;: false,</span><br><span class="line">        &quot;Containers&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Options&quot;: &#123;</span><br><span class="line">            &quot;com.docker.network.bridge.default_bridge&quot;: &quot;true&quot;,</span><br><span class="line">            &quot;com.docker.network.bridge.enable_icc&quot;: &quot;true&quot;,</span><br><span class="line">            &quot;com.docker.network.bridge.enable_ip_masquerade&quot;: &quot;true&quot;,</span><br><span class="line">            &quot;com.docker.network.bridge.host_binding_ipv4&quot;: &quot;0.0.0.0&quot;,</span><br><span class="line">            &quot;com.docker.network.bridge.name&quot;: &quot;docker0&quot;,</span><br><span class="line">            &quot;com.docker.network.driver.mtu&quot;: &quot;1500&quot;</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;Labels&quot;: &#123;&#125;</span><br><span class="line">    &#125;</span><br><span class="line">]</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run  -it busybox sh   <span class="comment"># 新建容器1</span></span></span><br><span class="line">/ # ifconfig eth0 </span><br><span class="line">eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:02  </span><br><span class="line">          inet addr:172.17.0.2  Bcast:172.17.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:7 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0 </span><br><span class="line">          RX bytes:586 (586.0 B)  TX bytes:0 (0.0 B)</span><br><span class="line">/ # hostname </span><br><span class="line">14c9f17fe0fc</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run  -it busybox sh    <span class="comment"># 新建容器2--默认网桥</span></span></span><br><span class="line">/ # ifconfig eth0 </span><br><span class="line">eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:03  </span><br><span class="line">          inet addr:172.17.0.3  Bcast:172.17.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:6 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0 </span><br><span class="line">          RX bytes:516 (516.0 B)  TX bytes:0 (0.0 B)</span><br><span class="line">/ # hostname </span><br><span class="line">a0532f2f769a</span><br></pre></td></tr></table></figure>

<p>在容器1中ping容器2的IP地址和主机名</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">/ # ping 172.17.0.3 -c 1          </span><br><span class="line">PING 172.17.0.3 (172.17.0.3): 56 data bytes</span><br><span class="line">64 bytes from 172.17.0.3: seq=0 ttl=64 time=0.049 ms</span><br><span class="line"></span><br><span class="line">--- 172.17.0.3 ping statistics ---</span><br><span class="line">1 packets transmitted, 1 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 0.049/0.049/0.049 ms</span><br><span class="line"></span><br><span class="line">/ # ping a0532f2f769a    </span><br><span class="line">ping: bad address &#x27;a0532f2f769a&#x27;</span><br></pre></td></tr></table></figure>

<p>在容器2中ping容器1的IP地址和主机名</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">/ # ping 172.17.0.2 -c 1             </span><br><span class="line">PING 172.17.0.2 (172.17.0.2): 56 data bytes</span><br><span class="line">64 bytes from 172.17.0.2: seq=0 ttl=64 time=6.461 ms</span><br><span class="line"></span><br><span class="line">--- 172.17.0.2 ping statistics ---</span><br><span class="line">1 packets transmitted, 1 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 6.461/6.461/6.461 ms</span><br><span class="line"></span><br><span class="line">/ # ping 14c9f17fe0fc              # 在容器2中ping容器1的主机名，失败</span><br><span class="line">ping: bad address &#x27;14c9f17fe0fc&#x27;</span><br></pre></td></tr></table></figure>

<p>由此可知，在同一台宿主机上，默认网桥可以通过IP地址通信，不能通过主机名通信。</p>
<h3 id="新建网桥：可通过主机名和IP通信"><a href="#新建网桥：可通过主机名和IP通信" class="headerlink" title="新建网桥：可通过主机名和IP通信"></a>新建网桥：可通过主机名和IP通信</h3><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network create new_net</span></span><br><span class="line">f72b4eaaf552cc24efc467f3b630031c86ab649c2e0318ac26de1f1d72b79f21</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network <span class="built_in">ls</span></span> </span><br><span class="line">NETWORK ID     NAME      DRIVER    SCOPE</span><br><span class="line">b3064d19f20d   bridge    bridge    local</span><br><span class="line">bca4b3029dbe   host      host      local</span><br><span class="line">f72b4eaaf552   new_net   bridge    local     # 新建网桥，默认也是桥接</span><br><span class="line">ecd4e3687fb9   none      null      local</span><br><span class="line"></span><br><span class="line">查看新建网桥new_net的详细信息</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network inspect new_net</span></span><br><span class="line">[</span><br><span class="line">    &#123;</span><br><span class="line">        &quot;Name&quot;: &quot;new_net&quot;,</span><br><span class="line">        &quot;Id&quot;: &quot;f72b4eaaf552cc24efc467f3b630031c86ab649c2e0318ac26de1f1d72b79f21&quot;,</span><br><span class="line">        &quot;Created&quot;: &quot;2021-04-01T21:36:27.933857446+08:00&quot;,</span><br><span class="line">        &quot;Scope&quot;: &quot;local&quot;,</span><br><span class="line">        &quot;Driver&quot;: &quot;bridge&quot;,</span><br><span class="line">        &quot;EnableIPv6&quot;: false,</span><br><span class="line">        &quot;IPAM&quot;: &#123;</span><br><span class="line">            &quot;Driver&quot;: &quot;default&quot;,</span><br><span class="line">            &quot;Options&quot;: &#123;&#125;,</span><br><span class="line">            &quot;Config&quot;: [</span><br><span class="line">                &#123;</span><br><span class="line">                    &quot;Subnet&quot;: &quot;172.18.0.0/16&quot;,    # 网段，默认网段是172.18.0.0/16</span><br><span class="line">                    &quot;Gateway&quot;: &quot;172.18.0.1&quot;</span><br><span class="line">                &#125;</span><br><span class="line">            ]</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;Internal&quot;: false,</span><br><span class="line">        &quot;Attachable&quot;: false,</span><br><span class="line">        &quot;Ingress&quot;: false,</span><br><span class="line">        &quot;ConfigFrom&quot;: &#123;</span><br><span class="line">            &quot;Network&quot;: &quot;&quot;</span><br><span class="line">        &#125;,</span><br><span class="line">        &quot;ConfigOnly&quot;: false,</span><br><span class="line">        &quot;Containers&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Options&quot;: &#123;&#125;,</span><br><span class="line">        &quot;Labels&quot;: &#123;&#125;</span><br><span class="line">    &#125;</span><br><span class="line">]</span><br></pre></td></tr></table></figure>

<p>使用新建网桥<code>new_net</code>新建两个容器，分别在两个容器中通过IP地址和主机名进行ping测试。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run  -it --network new_net  busybox sh  <span class="comment"># 新建容器1</span></span></span><br><span class="line">/ # ifconfig eth0 </span><br><span class="line">eth0      Link encap:Ethernet  HWaddr 02:42:AC:12:00:02  </span><br><span class="line">          inet addr:172.18.0.2  Bcast:172.18.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:13 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0 </span><br><span class="line">          RX bytes:1102 (1.0 KiB)  TX bytes:0 (0.0 B)</span><br><span class="line"></span><br><span class="line">/ # hostname </span><br><span class="line">d0999162dce9</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run  -it --network new_net  busybox sh  <span class="comment"># 新建容器2</span></span></span><br><span class="line">/ # ifconfig eth0 </span><br><span class="line">eth0      Link encap:Ethernet  HWaddr 02:42:AC:12:00:03  </span><br><span class="line">          inet addr:172.18.0.3  Bcast:172.18.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:7 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0 </span><br><span class="line">          RX bytes:586 (586.0 B)  TX bytes:0 (0.0 B)</span><br><span class="line"></span><br><span class="line">/ # hostname </span><br><span class="line">f4743940a945</span><br></pre></td></tr></table></figure>

<p>在容器1中ping容器2的IP地址和主机名。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">在容器1中通过ping命令ping容器2IP地址和容器2主机名</span></span><br><span class="line">/ # ping 172.18.0.3 -c 1                         # 在容器1中ping容器2IP地址成功</span><br><span class="line">PING 172.18.0.3 (172.18.0.3): 56 data bytes</span><br><span class="line">64 bytes from 172.18.0.3: seq=0 ttl=64 time=0.094 ms</span><br><span class="line"></span><br><span class="line">--- 172.18.0.3 ping statistics ---</span><br><span class="line">1 packets transmitted, 1 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 0.094/0.094/0.094 ms</span><br><span class="line">/ # </span><br><span class="line">/ # ping f4743940a945 -c 1                      # 在容器1中ping容器2主机名成功，并自动解析出IP地址</span><br><span class="line">PING f4743940a945 (172.18.0.3): 56 data bytes   # 通过主机名f4743940a945解析出IP地址--172.18.0.3</span><br><span class="line">64 bytes from 172.18.0.3: seq=0 ttl=64 time=0.057 ms</span><br><span class="line"></span><br><span class="line">--- f4743940a945 ping statistics ---</span><br><span class="line">1 packets transmitted, 1 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 0.057/0.057/0.057 ms</span><br></pre></td></tr></table></figure>

<p>在容器2中ping容器1的IP地址和主机名</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">在容器2中通过Ping命令ping容器1的IP地址和主机名</span></span><br><span class="line">/ # ping 172.18.0.2 -c 1                     # 在容器1中ping容器1IP地址成功</span><br><span class="line">PING 172.18.0.2 (172.18.0.2): 56 data bytes</span><br><span class="line">64 bytes from 172.18.0.2: seq=0 ttl=64 time=0.050 ms</span><br><span class="line"></span><br><span class="line">--- 172.18.0.2 ping statistics ---</span><br><span class="line">1 packets transmitted, 1 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 0.050/0.050/0.050 ms</span><br><span class="line"></span><br><span class="line">/ # ping d0999162dce9 -c 1                    # 在容器2中ping容器1IP地址成功</span><br><span class="line">PING d0999162dce9 (172.18.0.2): 56 data bytes</span><br><span class="line">64 bytes from 172.18.0.2: seq=0 ttl=64 time=0.060 ms</span><br><span class="line"></span><br><span class="line">--- d0999162dce9 ping statistics ---</span><br><span class="line">1 packets transmitted, 1 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 0.060/0.060/0.060 ms</span><br></pre></td></tr></table></figure>

<h2 id="几个常见的docker网络问题"><a href="#几个常见的docker网络问题" class="headerlink" title="几个常见的docker网络问题"></a>几个常见的docker网络问题</h2><h3 id="安装dockers和启动容器前后网络变化"><a href="#安装dockers和启动容器前后网络变化" class="headerlink" title="安装dockers和启动容器前后网络变化"></a>安装dockers和启动容器前后网络变化</h3><p>我们从下面两个方面来查看网络的变化情况。</p>
<ol>
<li><p>安装和启动docker前后，宿主机上网络的变化</p>
</li>
<li><p>启动一个容器后，查看容器内发收数据包与网桥docker0上新增的端口收发数据包的情况</p>
</li>
</ol>
<h4 id="安装和启动docker前后"><a href="#安装和启动docker前后" class="headerlink" title="安装和启动docker前后"></a>安装和启动docker前后</h4><ul>
<li><p><strong>安装docker前，宿主机上的网络情况</strong></p>
<p>  在未安装docker软件包之前，使用<code>ip a</code>查看宿主机网络信息如下：</p>
</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a</span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:46:24:04 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.130/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::9ecf:f41f:ee57:9f86/64 scope link noprefixroute </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">       </span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">iptables-save   <span class="comment"># iptables规则为空</span></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"></span></span><br><span class="line"><span class="language-bash"></span><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">yum  -y install bridge-utils   <span class="comment"># 网桥管理工具</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">brctl show</span></span><br><span class="line">bridge name	     bridge id		 STP enabled	  interfaces    # 无数据信息</span><br><span class="line"><span class="meta prompt_"># </span></span><br></pre></td></tr></table></figure>

<ul>
<li><p><strong>安装docker后，宿主机的网络情况</strong></p>
<p>  安装docker软件包并启动docker(<code>systemctl start docker</code>)后，使用<code>ip a</code>查看宿主机网络信息如下：</p>
</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">systemctl start docker</span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a</span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:46:24:04 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.130/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::9ecf:f41f:ee57:9f86/64 scope link noprefixroute </span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;NO-CARRIER,BROADCAST,MULTICAST,UP&gt; mtu 1500 qdisc noqueue state DOWN group default </span><br><span class="line">    link/ether 02:42:d9:02:ec:81 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">            </span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">brctl  show</span></span><br><span class="line">bridge name	  bridge id		       STP enabled	  interfaces</span><br><span class="line">docker0		  8000.0242d902ec81	   no	</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">iptables-save</span> </span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Generated by iptables-save v1.4.21 on Tue Feb 16 14:11:28 2021</span></span><br><span class="line">*nat</span><br><span class="line">:PREROUTING ACCEPT [0:0]</span><br><span class="line">:INPUT ACCEPT [0:0]</span><br><span class="line">:OUTPUT ACCEPT [1:124]</span><br><span class="line">:POSTROUTING ACCEPT [1:124]</span><br><span class="line">:DOCKER - [0:0]</span><br><span class="line">-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER</span><br><span class="line">-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER</span><br><span class="line">-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE</span><br><span class="line">-A DOCKER -i docker0 -j RETURN</span><br><span class="line">COMMIT</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Completed on Tue Feb 16 14:11:28 2021</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Generated by iptables-save v1.4.21 on Tue Feb 16 14:11:28 2021</span></span><br><span class="line">*filter</span><br><span class="line">:INPUT ACCEPT [17:1096]</span><br><span class="line">:FORWARD DROP [0:0]</span><br><span class="line">:OUTPUT ACCEPT [11:2692]</span><br><span class="line">:DOCKER - [0:0]</span><br><span class="line">:DOCKER-ISOLATION-STAGE-1 - [0:0]</span><br><span class="line">:DOCKER-ISOLATION-STAGE-2 - [0:0]</span><br><span class="line">:DOCKER-USER - [0:0]</span><br><span class="line">-A FORWARD -j DOCKER-USER</span><br><span class="line">-A FORWARD -j DOCKER-ISOLATION-STAGE-1</span><br><span class="line">-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</span><br><span class="line">-A FORWARD -o docker0 -j DOCKER</span><br><span class="line">-A FORWARD -i docker0 ! -o docker0 -j ACCEPT</span><br><span class="line">-A FORWARD -i docker0 -o docker0 -j ACCEPT</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-1 -j RETURN</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-2 -j RETURN</span><br><span class="line">-A DOCKER-USER -j RETURN</span><br><span class="line">COMMIT</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Completed on Tue Feb 16 14:11:28 2021</span></span><br></pre></td></tr></table></figure>

<p>有上述可知，在启动docker时，新建了一个名叫docker0的网桥。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ifconfig docker0</span></span><br><span class="line">docker0: flags=4099&lt;UP,BROADCAST,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255</span><br><span class="line">        ether 02:42:55:5e:01:6e  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 0  bytes 0 (0.0 B) # 显示接收的数据包，所有的容器都是通过docker0网桥接收的数据包，这里是汇总</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 0  bytes 0 (0.0 B)  # 显示发送的数据包，所有的容器都是通过docker0网桥发送的数据包，这里是汇总</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br></pre></td></tr></table></figure>

<h4 id="启动容器后"><a href="#启动容器后" class="headerlink" title="启动容器后"></a>启动容器后</h4><p>此时我们启动一个容器，查看<strong>网桥docker0上新增端口</strong>数据包的变化</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker image <span class="built_in">ls</span></span></span><br><span class="line">REPOSITORY   TAG              IMAGE ID       CREATED         SIZE</span><br><span class="line">nginx        latest           0901fa9da894   7 months ago    132MB</span><br><span class="line">busybox      latest           c7c37e472d31   7 months ago    1.22MB</span><br><span class="line">centos       centos7.6.1810   f1cb7c7d58b7   23 months ago   202MB</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -d -p 80:80 --name web01 0901fa9da894   <span class="comment"># 启动一个nginx的容器</span></span></span><br><span class="line">ed8ac3e3190d411b5485d9dd58563cb503235c4d3c2b8e4ed0301c163d1c8bc2</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">ls</span></span> </span><br><span class="line">CONTAINER ID  IMAGE      COMMAND               CREATED        STATUS        PORTS          NAMES</span><br><span class="line">ed8ac3e3190d  0901fa9da894  &quot;/docker-entrypoint.…&quot;  1 minutes ago Up 1 minutes 0.0.0.0:80-&gt;80/tcp web01</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">brctl  show</span></span><br><span class="line">bridge name	bridge id		STP enabled	interfaces</span><br><span class="line">docker0		8000.0242555e016e	no		veth830784a   # 启动容器后，docker0上新增了一个端口</span><br><span class="line"></span><br><span class="line">[root@docker20 ~]# ifconfig veth830784a</span><br><span class="line">veth830784a: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet6 fe80::38dc:e3ff:fe14:a6fc  prefixlen 64  scopeid 0x20&lt;link&gt;</span><br><span class="line">        ether 3a:dc:e3:14:a6:fc  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 0  bytes 0 (0.0 B)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 8  bytes 656 (656.0 B)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br></pre></td></tr></table></figure>

<p>容器启动后，使用windows主机访问nginx网页</p>
<p><img src="/pic/docker-pic/image-20210215184302351.png" alt="image-20210215184302351"></p>
<p>此时查看<strong>docker0中新增端口</strong>的网络流量跟nginx容器的网络流量</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker0中新增端口的网络流量：</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ifconfig veth830784a</span></span><br><span class="line">veth830784a: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet6 fe80::38dc:e3ff:fe14:a6fc  prefixlen 64  scopeid 0x20&lt;link&gt;</span><br><span class="line">        ether 3a:dc:e3:14:a6:fc  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 81  bytes 4314 (4.2 KiB)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 89  bytes 5890 (5.7 KiB)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">查看nginx容器的网络流量：首先进入nginx容器中，然后执行ifconfig命令，最后对比数据包的大小</span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">cp</span> /usr/sbin/ifconfig ed8ac3e3190d:/usr/sbin  <span class="comment"># 将ifconfig命令导入到容器中</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it ed8ac3e3190d bash  <span class="comment"># 进入容器</span></span></span><br><span class="line">root@ed8ac3e3190d:/# ifconfig eth0</span><br><span class="line">eth0: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 172.17.0.2  netmask 255.255.0.0  broadcast 172.17.255.255</span><br><span class="line">        ether 02:42:ac:11:00:02  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 89  bytes 5890 (5.7 KiB)  # 流出的流量，对应网桥docker0新增端口veth830784a流入的流量</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 81  bytes 4314 (4.2 KiB)  # 流入的流量，对应网桥docker0新增端口veth830784a流出的流量</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br></pre></td></tr></table></figure>

<p>此时截图如下：</p>
<p><img src="/pic/docker-pic/image-20210215195308307.png" alt="image-20210215195308307"></p>
<h3 id="同台宿主机上两个容器的数据包走向"><a href="#同台宿主机上两个容器的数据包走向" class="headerlink" title="同台宿主机上两个容器的数据包走向"></a>同台宿主机上两个容器的数据包走向</h3><p>在同台宿主机上开启两个容器，在两个容器中互ping，查看流量走向</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">新建两个容器，并同时通过xshell界面连接进入容器</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -it -d --name Centos7-01 f1cb7c7d58b7  /bin/bash</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -it -d --name Centos7-02 f1cb7c7d58b7  /bin/bash</span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">ls</span></span> </span><br><span class="line">CONTAINER ID   IMAGE          COMMAND       CREATED         STATUS         PORTS     NAMES</span><br><span class="line">b8d07e8812fb   f1cb7c7d58b7   &quot;/bin/bash&quot;   2 minutes ago   Up 2 minutes             Centos7-02</span><br><span class="line">a7495c7a321a   f1cb7c7d58b7   &quot;/bin/bash&quot;   4 minutes ago   Up 4 minutes             Centos7-01</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">进入容器1，并安装tcpdump</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it a7495c7a321a  bash</span></span><br><span class="line">[root@a7495c7a321a /]# yum -y install tcpdump</span><br><span class="line">[root@a7495c7a321a /]# ifconfig  eth0 </span><br><span class="line">eth0: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 172.17.0.2  netmask 255.255.0.0  broadcast 172.17.255.255</span><br><span class="line">        ether 02:42:ac:11:00:02  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 4015  bytes 13691921 (13.0 MiB)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 3103  bytes 171543 (167.5 KiB)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">进入容器2，并安装tcpdump</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it b8d07e8812fb bash</span></span><br><span class="line">[root@b8d07e8812fb /]# yum -y install tcpdump</span><br><span class="line">[root@b8d07e8812fb /]# ifconfig  eth0</span><br><span class="line">eth0: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 172.17.0.3  netmask 255.255.0.0  broadcast 172.17.255.255</span><br><span class="line">        ether 02:42:ac:11:00:03  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 4423  bytes 13712937 (13.0 MiB)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 3334  bytes 184083 (179.7 KiB)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">在容器2中ping容器1(容器2-b8d07e8812fb打开两个xhsell界面，一个用着ping，一个用着抓包)</span></span><br><span class="line">[root@b8d07e8812fb /]# ping 172.17.0.2 -c 1</span><br><span class="line">PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.</span><br><span class="line">64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.188 ms</span><br><span class="line"></span><br><span class="line">--- 172.17.0.2 ping statistics ---</span><br><span class="line">1 packets transmitted, 1 received, 0% packet loss, time 0ms</span><br><span class="line">rtt min/avg/max/mdev = 0.188/0.188/0.188/0.000 ms</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">在ping的同时，在容器1和容器2以及宿主机上执行tcpdump命令，分别查看容器1和容器2中网卡eth0和宿主机上对应容器1和容器2的端口和docker0的icmp流量的情况</span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 1. 容器1中eth0的抓包情况</span></span></span><br><span class="line">[root@a7495c7a321a /]# tcpdump -i eth0 icmp</span><br><span class="line">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</span><br><span class="line">listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">13:08:06.501115 IP 172.17.0.3 &gt; a7495c7a321a: ICMP echo request, id 113, seq 1, length 64</span><br><span class="line">13:08:06.501171 IP a7495c7a321a &gt; 172.17.0.3: ICMP echo reply, id 113, seq 1, length 64</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 2. 与容器1中eth0对应的接口veth5526b5c的抓包情况</span></span></span><br><span class="line">[root@docker20 ~]# tcpdump -i veth5526b5c icmp</span><br><span class="line">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</span><br><span class="line">listening on veth5526b5c, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">21:08:06.501112 IP 172.17.0.3 &gt; 172.17.0.2: ICMP echo request, id 113, seq 1, length 64</span><br><span class="line">21:08:06.501173 IP 172.17.0.2 &gt; 172.17.0.3: ICMP echo reply, id 113, seq 1, length 64</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 3. 容器2中eth0的抓包情况</span></span></span><br><span class="line">[root@b8d07e8812fb /]# tcpdump -i eth0 icmp</span><br><span class="line">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</span><br><span class="line">listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">13:08:06.501012 IP b8d07e8812fb &gt; 172.17.0.2: ICMP echo request, id 113, seq 1, length 64</span><br><span class="line">13:08:06.501181 IP 172.17.0.2 &gt; b8d07e8812fb: ICMP echo reply, id 113, seq 1, length 64</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 4. 容器2中eth0对应的接口veth1abfdc9的抓包情况</span></span></span><br><span class="line">[root@docker20 ~]# tcpdump -i veth1abfdc9 icmp </span><br><span class="line">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</span><br><span class="line">listening on veth1abfdc9, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">21:08:06.501046 IP 172.17.0.3 &gt; 172.17.0.2: ICMP echo request, id 113, seq 1, length 64</span><br><span class="line">21:08:06.501180 IP 172.17.0.2 &gt; 172.17.0.3: ICMP echo reply, id 113, seq 1, length 64</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 5. 宿主机docker0的抓包情况</span></span></span><br><span class="line">[root@docker20 ~]# tcpdump  -i docker0 icmp</span><br><span class="line">tcpdump: verbose output suppressed, use -v or -vv for full protocol decode</span><br><span class="line">listening on docker0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">21:08:06.501046 IP 172.17.0.3 &gt; 172.17.0.2: ICMP echo request, id 113, seq 1, length 64</span><br><span class="line">21:08:06.501173 IP 172.17.0.2 &gt; 172.17.0.3: ICMP echo reply, id 113, seq 1, length 64</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">此时，宿主机和容器1和容器2中的路由信息如下：</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">route -n</span> </span><br><span class="line">Kernel IP routing table</span><br><span class="line">Destination     Gateway         Genmask         Flags Metric Ref    Use Iface</span><br><span class="line">0.0.0.0         10.138.3.2      0.0.0.0         UG    100    0        0 ens33</span><br><span class="line">10.138.3.0      0.0.0.0         255.255.255.0   U     100    0        0 ens33</span><br><span class="line">172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 docker0</span><br><span class="line"></span><br><span class="line">[root@a7495c7a321a /]# route -n </span><br><span class="line">Kernel IP routing table</span><br><span class="line">Destination     Gateway         Genmask         Flags Metric Ref    Use Iface</span><br><span class="line">0.0.0.0         172.17.0.1      0.0.0.0         UG    0      0        0 eth0</span><br><span class="line">172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0</span><br><span class="line"></span><br><span class="line">[root@b8d07e8812fb /]# route  -n </span><br><span class="line">Kernel IP routing table</span><br><span class="line">Destination     Gateway         Genmask         Flags Metric Ref    Use Iface</span><br><span class="line">0.0.0.0         172.17.0.1      0.0.0.0         UG    0      0        0 eth0</span><br><span class="line">172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>​        由上述四个网卡和一个网桥的抓包情况可以看出，同一台宿主机上同网段容器之间是通过网桥docker0直接互通，流程图如下：</p>
<p><img src="/pic/docker-pic/image-20210215212140788.png" alt="image-20210215212140788"></p>
<p>同一宿主机上容器网络流量走向总结：</p>
<p>同一台宿主机中，我们在容器2中ping容器1，首先在容器2中查询路由表，得到最优路径(目标地址为172.17.0.2，是属于目标地址为172.17.0.0的路由表，因此会使用该路由信息进行数据传递)，此时流量是从容器2的eth0网卡走向容器2对应在docker0上的接口veth1abfdc9，达到网桥docker0后，发现是同网段的ip地址，通过查询mac地址表，找出容器1的IP地址对应的mac地址，将数据包通过docker0上与容器1相连接的veth5526b5c端口将数据发送给容器1的网卡，数据包返回时操作流程也是一样。</p>
<h3 id="容器连接外网时的数据包走向：源地址转换"><a href="#容器连接外网时的数据包走向：源地址转换" class="headerlink" title="容器连接外网时的数据包走向：源地址转换"></a>容器连接外网时的数据包走向：源地址转换</h3><p><img src="/pic/docker-pic/image-20210402103617452.png" alt="image-20210402103617452"></p>
<p>​		在容器1(IP地址为172.17.0.3)中ping百度，抓取容器2的网卡、docker0、ens33，查看数据包的走向</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ping百度</span></span><br><span class="line">[root@b8d07e8812fb /]# ping baidu.com -c 2</span><br><span class="line">PING baidu.com (220.181.38.148) 56(84) bytes of data.</span><br><span class="line">64 bytes from baidu.com (220.181.38.148): icmp_seq=1 ttl=127 time=12.2 ms</span><br><span class="line">64 bytes from baidu.com (220.181.38.148): icmp_seq=2 ttl=127 time=9.94 ms</span><br><span class="line"></span><br><span class="line">--- baidu.com ping statistics ---</span><br><span class="line">2 packets transmitted, 2 received, 0% packet loss, time 1004ms</span><br><span class="line">rtt min/avg/max/mdev = 9.942/11.119/12.296/1.177 ms</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">抓包情况</span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 1.容器2中eth0的抓包和路由信息</span></span></span><br><span class="line">[root@b8d07e8812fb /]# tcpdump -i eth0 icmp -w eth0.cap  # 将输出信息保存到eth0.cap中，</span><br><span class="line">tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">^C4 packets captured</span><br><span class="line">4 packets received by filter</span><br><span class="line">0 packets dropped by kernel</span><br><span class="line"></span><br><span class="line">[root@b8d07e8812fb /]# route -n </span><br><span class="line">Kernel IP routing table</span><br><span class="line">Destination     Gateway         Genmask         Flags Metric Ref    Use Iface</span><br><span class="line">0.0.0.0         172.17.0.1      0.0.0.0         UG    0      0        0 eth0  # 走这一条路由</span><br><span class="line">172.17.0.0      0.0.0.0         255.255.0.0     U     0      0        0 eth0</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 2.宿主机上docker0的抓包</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">tcpdump  -i docker0 icmp -w docker0.cap</span></span><br><span class="line">tcpdump: listening on docker0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">^C14 packets captured</span><br><span class="line">14 packets received by filter</span><br><span class="line">0 packets dropped by kernel</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 3.宿主机上ens33的抓包</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">tcpdump -i ens33  icmp  -w ens33.cap</span></span><br><span class="line">tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">^C4 packets captured</span><br><span class="line">4 packets received by filter</span><br><span class="line">0 packets dropped by kernel</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">cp</span> b8d07e8812fb:/eth0.<span class="built_in">cap</span> .  <span class="comment"># 将容器中的eth0.cap拷贝到宿主机上</span></span></span><br><span class="line">[root@docker20 ~]# ll -h *.cap  # 导出，通过wireshark打开数据包，进行网络走向分析</span><br><span class="line">-rw-r--r-- 1 tcpdump tcpdump 480 Feb 15 22:55 docker0.cap</span><br><span class="line">-rw-r--r-- 1 tcpdump tcpdump 480 Feb 15 22:55 ens33.cap</span><br><span class="line">-rw-r--r-- 1 root    root    480 Feb 15 22:55 eth0.cap</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 4.宿主机的iptables规则</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">iptables-save</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Generated by iptables-save v1.4.21 on Mon Feb 15 21:39:23 2021</span></span><br><span class="line">*filter</span><br><span class="line">:INPUT ACCEPT [4043:876124]</span><br><span class="line">:FORWARD DROP [0:0]</span><br><span class="line">:OUTPUT ACCEPT [2946:334234]</span><br><span class="line">:DOCKER - [0:0]</span><br><span class="line">:DOCKER-ISOLATION-STAGE-1 - [0:0]</span><br><span class="line">:DOCKER-ISOLATION-STAGE-2 - [0:0]</span><br><span class="line">:DOCKER-USER - [0:0]</span><br><span class="line">-A FORWARD -j DOCKER-USER</span><br><span class="line">-A FORWARD -j DOCKER-ISOLATION-STAGE-1</span><br><span class="line">-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</span><br><span class="line">-A FORWARD -o docker0 -j DOCKER</span><br><span class="line">-A FORWARD -i docker0 ! -o docker0 -j ACCEPT</span><br><span class="line">-A FORWARD -i docker0 -o docker0 -j ACCEPT</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-1 -j RETURN</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-2 -j RETURN</span><br><span class="line">-A DOCKER-USER -j RETURN</span><br><span class="line">COMMIT</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Completed on Mon Feb 15 21:39:23 2021</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Generated by iptables-save v1.4.21 on Mon Feb 15 21:39:23 2021</span></span><br><span class="line">*nat</span><br><span class="line">:PREROUTING ACCEPT [146:9425]</span><br><span class="line">:INPUT ACCEPT [7:474]</span><br><span class="line">:OUTPUT ACCEPT [49:3260]</span><br><span class="line">:POSTROUTING ACCEPT [53:3596]</span><br><span class="line">:DOCKER - [0:0]</span><br><span class="line">-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER</span><br><span class="line">-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER</span><br><span class="line">-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE</span><br><span class="line">-A DOCKER -i docker0 -j RETURN</span><br><span class="line">COMMIT</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Completed on Mon Feb 15 21:39:23 2021</span></span><br></pre></td></tr></table></figure>

<blockquote>
<p>详解iptables规则：-A POSTROUTING -s 172.17.0.0&#x2F;16 ! -o docker0 -j MASQUERADE，这条iptables规则是将源地址为172.17.0.0&#x2F;16的数据包(也就是docker容器产生的数据包，容器的网关是docker0的地址，因此必然会经过docker0)，而不是docker0网卡直接发出的数据包，进行源地址转换，转换成docker主机网卡的地址，再发送出去</p>
</blockquote>
<p>下面我们通过<code>wireshark软件</code>打开三个文件，按照<code>容器eth0--&gt;docker0--&gt;ens33</code>查看数据包流出(即请求信息request)情况，再通过<code>ens33--&gt;docker0--&gt;容器eth0</code>查看数据包流入(即回复信息reply)情况</p>
<h4 id="数据包流出-request-情况"><a href="#数据包流出-request-情况" class="headerlink" title="数据包流出(request)情况"></a>数据包流出(request)情况</h4><ul>
<li><strong>容器网卡eth0.cap的流量流出走向</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210215230122269.png" alt="image-20210215230122269"></p>
<ul>
<li><strong>网桥docker0的流量流出走向</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210215230242488.png" alt="image-20210215230242488"></p>
<ul>
<li><strong>宿主机网卡ens33的流量流出走向</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210215230443133.png" alt="image-20210215230443133"></p>
<h4 id="5-3-2-数据包流入-reply-情况"><a href="#5-3-2-数据包流入-reply-情况" class="headerlink" title="5.3.2 数据包流入(reply)情况"></a>5.3.2 数据包流入(reply)情况</h4><ul>
<li><strong>宿主机网卡ens33.cap数据包流入：</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210215231639194.png" alt="image-20210215231639194"></p>
<ul>
<li><strong>网桥docker0.cap数据包流入：</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210215231850469.png" alt="image-20210215231850469"></p>
<ul>
<li><strong>容器网卡eth0.cap的流量流入：</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210215232001560.png" alt="image-20210215232001560"></p>
<p>因此数据流量的走向如下图所示：</p>
<p><img src="/pic/docker-pic/image-20210215215133565.png" alt="image-20210215215133565"></p>
<p>​		容器2在ping百度的时候，查询路由表，发现要达到百度需要通过目标地址为<code>0.0.0.0</code> 的路由，因此将数据包发送给容器2的网卡<code>eth0</code>，<code>eth0</code>将数据包发送到网桥<code>docker0</code>上的端口<code>veth1abfdc9</code>，此时，由于目标地址不是同网段，因此就不能直接广播了，就需要将数据包通过<code>docker0</code>转发出去，此时Linux的<code>iptables</code>规则就发挥作用了，首先通过<code>snat</code>规则将数据包传输到公网上，待百度服务器响应后，再将数据包传输给容器2的网卡，最后完成数据包的传递。</p>
<h3 id="容器连接外网时的数据包走向：目标地址转换"><a href="#容器连接外网时的数据包走向：目标地址转换" class="headerlink" title="容器连接外网时的数据包走向：目标地址转换"></a>容器连接外网时的数据包走向：目标地址转换</h3><p><img src="/pic/docker-pic/image-20210402103500231.png" alt="image-20210402103500231"></p>
<p>​		启动一个CentOS7的容器，通过外网访问(SSH协议)该容器，查看访问过程.</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -td -p 10.138.3.130:20022:22 --name Centos7-ssh f1cb7c7d58b7  /bin/bash</span></span><br><span class="line">40c86bbddc3a9ab53ddd2742f29e5abc7b48796c37fad26b126706bf5d9857ea</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker ps</span> </span><br><span class="line">CONTAINER ID   IMAGE          COMMAND       CREATED      STATUS          PORTS     NAMES</span><br><span class="line">40c86bbddc3a f1cb7c7d58b7 &quot;/bin/bash&quot; 5 seconds ago Up 4 seconds  10.138.3.130:20022-&gt;22/tcp Centos7-ssh</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker port 40c86bbddc3a</span></span><br><span class="line">22/tcp -&gt; 10.138.3.130:20022</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">进入容器并安装启动openssh服务</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it 40c86bbddc3a bash</span></span><br><span class="line">[root@40c86bbddc3a ~]# yum -y install openssh*</span><br><span class="line">[root@40c86bbddc3a init.d]# ./sshd start</span><br><span class="line">[root@40c86bbddc3a ~]# netstat -lntp </span><br><span class="line">Active Internet connections (only servers)</span><br><span class="line">Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    </span><br><span class="line">tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      227/sshd            </span><br><span class="line">tcp6       0      0 :::22                   :::*                    LISTEN      227/sshd </span><br><span class="line"></span><br><span class="line">[root@40c86bbddc3a ~]# echo &quot;root:root&quot; | chpasswd    # 给root用户设置密码为root</span><br></pre></td></tr></table></figure>

<p>此时就可以通过xshell进行远程连接了</p>
<p><img src="/pic/docker-pic/image-20210216105143956.png" alt="image-20210216105143956"></p>
<p>我们通过抓包，查看数据包流量走向</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">容器的数据包</span></span><br><span class="line">[root@40c86bbddc3a ~]# tcpdump -i eth0 -w eth0.cap</span><br><span class="line">tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">^C36 packets captured</span><br><span class="line">36 packets received by filter</span><br><span class="line">0 packets dropped by kernel</span><br><span class="line">[root@40c86bbddc3a ~]# ll </span><br><span class="line">total 12</span><br><span class="line">-rw------- 1 root    root    3322 Dec  4  2018 anaconda-ks.cfg</span><br><span class="line">-rw-r--r-- 1 tcpdump tcpdump 7988 Feb 16 02:56 eth0.cap</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">宿主机上docker0的数据包</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">tcpdump -i docker0 -w docker0.cap</span></span><br><span class="line">tcpdump: listening on docker0, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">^C40 packets captured</span><br><span class="line">40 packets received by filter</span><br><span class="line">0 packets dropped by kernel</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">宿主机上ens33的数据包</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">tcpdump -i ens33 -w ens33.cap</span></span><br><span class="line">tcpdump: listening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes</span><br><span class="line">^C74 packets captured</span><br><span class="line">76 packets received by filter</span><br><span class="line">0 packets dropped by kernel</span><br></pre></td></tr></table></figure>

<p>将容器和宿主机上的数据包传输到pc上通过Wireshark打开</p>
<ul>
<li><strong>宿主机网卡enss33的抓包信息ens33.cap</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210216110825122.png" alt="image-20210216110825122"></p>
<ul>
<li><strong>网桥docker0的抓包信息docker0.cap</strong></li>
</ul>
<p><img src="/pic/docker-pic/image-20210216111142142.png" alt="image-20210216111142142"></p>
<ul>
<li>容器网卡eth0的抓包信息eth0.cap</li>
</ul>
<p><img src="/pic/docker-pic/image-20210216111332412.png" alt="image-20210216111332412"></p>
<p>通过上述抓包可以知道，ens33到docker0之间进行了目标地址和端口转换，流程图如下所示：</p>
<p><img src="/pic/docker-pic/image-20210216112509074.png" alt="image-20210216112509074"></p>
<p>此时docker主机上的iptables规则如下：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">iptables-save</span> </span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Generated by iptables-save v1.4.21 on Tue Feb 16 11:25:21 2021</span></span><br><span class="line">*nat</span><br><span class="line">:PREROUTING ACCEPT [119:7629]</span><br><span class="line">:INPUT ACCEPT [21:1394]</span><br><span class="line">:OUTPUT ACCEPT [4:267]</span><br><span class="line">:POSTROUTING ACCEPT [9:527]</span><br><span class="line">:DOCKER - [0:0]</span><br><span class="line">-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER</span><br><span class="line">-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER</span><br><span class="line">-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE</span><br><span class="line">-A POSTROUTING -s 172.17.0.2/32 -d 172.17.0.2/32 -p tcp -m tcp --dport 22 -j MASQUERADE</span><br><span class="line">-A DOCKER -i docker0 -j RETURN</span><br><span class="line">-A DOCKER -d 10.138.3.130/32 ! -i docker0 -p tcp -m tcp --dport 20022 -j DNAT --to-destination 172.17.0.2:22</span><br><span class="line">COMMIT</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Completed on Tue Feb 16 11:25:21 2021</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Generated by iptables-save v1.4.21 on Tue Feb 16 11:25:21 2021</span></span><br><span class="line">*filter</span><br><span class="line">:INPUT ACCEPT [2761:180272]</span><br><span class="line">:FORWARD DROP [0:0]</span><br><span class="line">:OUTPUT ACCEPT [2414:539236]</span><br><span class="line">:DOCKER - [0:0]</span><br><span class="line">:DOCKER-ISOLATION-STAGE-1 - [0:0]</span><br><span class="line">:DOCKER-ISOLATION-STAGE-2 - [0:0]</span><br><span class="line">:DOCKER-USER - [0:0]</span><br><span class="line">-A FORWARD -j DOCKER-USER</span><br><span class="line">-A FORWARD -j DOCKER-ISOLATION-STAGE-1</span><br><span class="line">-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT</span><br><span class="line">-A FORWARD -o docker0 -j DOCKER</span><br><span class="line">-A FORWARD -i docker0 ! -o docker0 -j ACCEPT</span><br><span class="line">-A FORWARD -i docker0 -o docker0 -j ACCEPT</span><br><span class="line">-A DOCKER -d 172.17.0.2/32 ! -i docker0 -o docker0 -p tcp -m tcp --dport 22 -j ACCEPT</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-1 -j RETURN</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP</span><br><span class="line">-A DOCKER-ISOLATION-STAGE-2 -j RETURN</span><br><span class="line">-A DOCKER-USER -j RETURN</span><br><span class="line">COMMIT</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">Completed on Tue Feb 16 11:25:21 2021</span></span><br></pre></td></tr></table></figure>

<blockquote>
<p>解析DNAT规则：-A DOCKER -d 10.138.3.130&#x2F;32 ! -i docker0 -p tcp -m tcp –dport 20022 -j DNAT –to-destination 172.17.0.2:22，意思是源地址是10.138.3.130，目标端口是20022，并且不是发送给docker0的数据包(在系统看来docker0和ens33是同一个网卡)，通过DNAT转换，将数据包发送给172.17.0.2的22号端口</p>
</blockquote>
<img src="/pic/docker-pic/image-20210402104606695.png" alt="image-20210402104606695" style="zoom:67%;" />



<h3 id="容器2引用容器1的网络，当容器1宕掉后，容器2的网络还能正常吗？"><a href="#容器2引用容器1的网络，当容器1宕掉后，容器2的网络还能正常吗？" class="headerlink" title="容器2引用容器1的网络，当容器1宕掉后，容器2的网络还能正常吗？"></a>容器2引用容器1的网络，当容器1宕掉后，容器2的网络还能正常吗？</h3><p>不能。容器1宕掉后会销毁网络，因此容器2此时只有lo网络了，不再拥有与容器1共享的网络。</p>
<p>实验如下：</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">清除掉所有容器</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">rm</span> `docker container <span class="built_in">ls</span> -a -q`</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">ls</span> -a</span> </span><br><span class="line">CONTAINER ID   IMAGE     COMMAND   CREATED   STATUS    PORTS     NAMES</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash"></span></span><br><span class="line"><span class="language-bash"></span><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">1.新建容器1</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -td --name share-net f1cb7c7d58b7 bash</span></span><br><span class="line">ead309a3e0bc3f769c6e08451bab0a47fb89106bf572d7751a7a0165624cdd69</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">2.新建容器2，使容器2共享容器1的网络</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -td --name net-son --network container:share-net  f1cb7c7d58b7 bash</span></span><br><span class="line">825c2559f41e7c5b0999feefd0630d1b4bdbe4e907e82ae94e5b521a84148d81</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">3.检查两个容器是否同一个网络</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">ls</span> -a -q</span> </span><br><span class="line">825c2559f41e</span><br><span class="line">ead309a3e0bc</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">cp</span> /usr/sbin/ifconfig 825c2559f41e:/usr/sbin/</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">cp</span> /usr/sbin/ifconfig ead309a3e0bc:/usr/sbin/</span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it 825c2559f41e bash  <span class="comment"># 进入容器1</span></span></span><br><span class="line">[root@ead309a3e0bc /]# ifconfig eth0   # 容器1，将要被共享网络的容器</span><br><span class="line">eth0: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 172.17.0.2  netmask 255.255.0.0  broadcast 172.17.255.255</span><br><span class="line">        ether 02:42:ac:11:00:02  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 8  bytes 656 (656.0 B)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 0  bytes 0 (0.0 B)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line">        </span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it 825c2559f41e bash</span></span><br><span class="line">[root@ead309a3e0bc /]# ifconfig  eth0  #容器2，共享容器1网络的容器</span><br><span class="line">eth0: flags=4163&lt;UP,BROADCAST,RUNNING,MULTICAST&gt;  mtu 1500</span><br><span class="line">        inet 172.17.0.2  netmask 255.255.0.0  broadcast 172.17.255.255</span><br><span class="line">        ether 02:42:ac:11:00:02  txqueuelen 0  (Ethernet)</span><br><span class="line">        RX packets 8  bytes 656 (656.0 B)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 0  bytes 0 (0.0 B)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">3.宕掉容器1，查看容器2的网络状况</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container stop ead309a3e0bc</span></span><br><span class="line">ead309a3e0bc</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">ls</span> -a</span> </span><br><span class="line">CONTAINER ID   IMAGE         COMMAND  CREATED      STATUS          PORTS         NAMES</span><br><span class="line">825c2559f41e   f1cb7c7d58b7  &quot;bash&quot;   8 minutes ago  Up 8 minutes                net-son</span><br><span class="line">ead309a3e0bc   f1cb7c7d58b7  &quot;bash&quot;   9 minutes ago  Exited (137) 31 seconds ago share-net</span><br><span class="line"></span><br><span class="line">[root@ead309a3e0bc /]# ifconfig   # 此时只有一个网络了，容器并没有退出</span><br><span class="line">lo: flags=73&lt;UP,LOOPBACK,RUNNING&gt;  mtu 65536</span><br><span class="line">        inet 127.0.0.1  netmask 255.0.0.0</span><br><span class="line">        loop  txqueuelen 1000  (Local Loopback)</span><br><span class="line">        RX packets 0  bytes 0 (0.0 B)</span><br><span class="line">        RX errors 0  dropped 0  overruns 0  frame 0</span><br><span class="line">        TX packets 0  bytes 0 (0.0 B)</span><br><span class="line">        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">需要注意的是，如果容器1没有启动，是不能重启容器2的，因此容器2的启动依赖于容器1的网络，即启动的顺序是：容器1启动完成后，才能启动容器2</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container restart 825c2559f41e</span></span><br><span class="line">Error response from daemon: Cannot restart container 825c2559f41e: cannot join network of a non running container: ead309a3e0bc3f769c6e08451bab0a47fb89106bf572d7751a7a0165624cdd69</span><br></pre></td></tr></table></figure>

<h3 id="同台宿主机，不同网桥上的两个容器的互通"><a href="#同台宿主机，不同网桥上的两个容器的互通" class="headerlink" title="同台宿主机，不同网桥上的两个容器的互通"></a>同台宿主机，不同网桥上的两个容器的互通</h3><p>思路：新建一个名称为new_bridge的bridge网桥，分别用new_bridge网桥和默认的bridge网桥运行容器，并使用<code>docker nework connect 网桥名称 容器名称</code>将在容器中新增一个网桥的网卡，实现互通。如<code>docker network connect bridge c2</code>，将在容器c2中新增一个<code>bridge</code>对应网段的新网卡。</p>
<ul>
<li>创建网桥</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">清空宿主机上的所有容器</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container <span class="built_in">rm</span> `docker container <span class="built_in">ls</span> -a -q`</span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">新建docker网桥</span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network <span class="built_in">ls</span>     <span class="comment"># docker宿主机上的默认网络</span></span></span><br><span class="line">NETWORK ID     NAME      DRIVER    SCOPE</span><br><span class="line">84b07138ff9e   bridge    bridge    local</span><br><span class="line">bca4b3029dbe   host      host      local</span><br><span class="line">ecd4e3687fb9   none      null      local</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network create new_bridge   <span class="comment"># 新建一个bridge网桥，名称为new_bridge</span></span></span><br><span class="line">c158263b11a08b4062dc21b5806141b017cf7a02d0eff4f57825a4064dc897eb</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network <span class="built_in">ls</span></span> </span><br><span class="line">NETWORK ID     NAME         DRIVER    SCOPE</span><br><span class="line">84b07138ff9e   bridge       bridge    local</span><br><span class="line">bca4b3029dbe   host         host      local</span><br><span class="line">c158263b11a0   new_bridge   bridge    local      # 新建网桥</span><br><span class="line">ecd4e3687fb9   none         null      local</span><br></pre></td></tr></table></figure>

<ul>
<li>创建两个不同网段的容器</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker image <span class="built_in">ls</span></span></span><br><span class="line">REPOSITORY   TAG       IMAGE ID       CREATED         SIZE</span><br><span class="line">busybox      latest    ff4a8eb070e1   2 weeks ago     1.24MB</span><br><span class="line">centos       centos7   eeb6ee3f44bd   13 months ago   204MB</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 使用默认网桥新建容器c1</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run -td --name c1 ff4a8eb070e1 sh</span></span><br><span class="line">1a64305ecbe5218580bc4082fd87534cf5ea35591ab9cd521be75824859011f4</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 使用新建网桥new_bridge新建容器c2</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker run --name c2 --network new_bridge -td ff4a8eb070e1  sh</span></span><br><span class="line">85070c598b8c84ac86bbb0811d074749c278b000069338bcc089c26d17f1ebd5</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker ps</span></span><br><span class="line">CONTAINER ID   IMAGE          COMMAND   CREATED         STATUS         PORTS     NAMES</span><br><span class="line">85070c598b8c   ff4a8eb070e1   &quot;sh&quot;      7 minutes ago   Up 7 minutes             c2</span><br><span class="line">1a64305ecbe5   ff4a8eb070e1   &quot;sh&quot;      7 minutes ago   Up 7 minutes             c1</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 容器c1的IP地址</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container inspect c1 | grep IPAddress</span></span><br><span class="line">            &quot;SecondaryIPAddresses&quot;: null,</span><br><span class="line">            &quot;IPAddress&quot;: &quot;172.17.0.2&quot;,</span><br><span class="line">                    &quot;IPAddress&quot;: &quot;172.17.0.2&quot;,</span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 容器c2的IP地址</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker container inspect c2 | grep IPAddress</span></span><br><span class="line">            &quot;SecondaryIPAddresses&quot;: null,</span><br><span class="line">            &quot;IPAddress&quot;: &quot;&quot;,</span><br><span class="line">                    &quot;IPAddress&quot;: &quot;172.18.0.2&quot;,</span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 此时宿主机的网络情况如下</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a</span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:54:e4:7e brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.130/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::9ecf:f41f:ee57:9f86/64 scope link noprefixroute</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default</span><br><span class="line">    link/ether 02:42:c2:92:b0:c7 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0   # 默认网桥</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:c2ff:fe92:b0c7/64 scope link</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">11: br-3733625e7c0b: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default</span><br><span class="line">    link/ether 02:42:2a:ca:a0:0a brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.18.0.1/16 brd 172.18.255.255 scope global br-3733625e7c0b   ## 新建网桥</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:2aff:feca:a00a/64 scope link</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">29: vethecc9115@if28: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default</span><br><span class="line">    link/ether 0e:70:26:8e:d7:fa brd ff:ff:ff:ff:ff:ff link-netnsid 0   ## 默认网桥对应的设备对</span><br><span class="line">    inet6 fe80::c70:26ff:fe8e:d7fa/64 scope link</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">31: veth863f55e@if30: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master br-3733625e7c0b state UP group default</span><br><span class="line">    link/ether 8e:3b:66:11:b6:39 brd ff:ff:ff:ff:ff:ff link-netnsid 1  ## 新建网桥对应的设备对</span><br><span class="line">    inet6 fe80::8c3b:66ff:fe11:b639/64 scope link</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">brctl show    <span class="comment">## 网桥设备对对应情况</span></span></span><br><span class="line">bridge name     bridge id               STP enabled     interfaces</span><br><span class="line">br-3733625e7c0b         8000.02422acaa00a       no              veth863f55e</span><br><span class="line">docker0         8000.0242c292b0c7       no              vethecc9115</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 宿主机与容器c1和容器c2的联通情况</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ping 172.18.0.2 -c 4</span></span><br><span class="line">PING 172.18.0.2 (172.18.0.2) 56(84) bytes of data.</span><br><span class="line">64 bytes from 172.18.0.2: icmp_seq=1 ttl=64 time=0.157 ms</span><br><span class="line">64 bytes from 172.18.0.2: icmp_seq=2 ttl=64 time=0.115 ms</span><br><span class="line">64 bytes from 172.18.0.2: icmp_seq=3 ttl=64 time=0.154 ms</span><br><span class="line">64 bytes from 172.18.0.2: icmp_seq=4 ttl=64 time=0.091 ms</span><br><span class="line"></span><br><span class="line">--- 172.18.0.2 ping statistics ---</span><br><span class="line">4 packets transmitted, 4 received, 0% packet loss, time 3002ms</span><br><span class="line">rtt min/avg/max/mdev = 0.091/0.129/0.157/0.028 ms</span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ping 172.17.0.2 -c 4</span></span><br><span class="line">PING 172.17.0.2 (172.17.0.2) 56(84) bytes of data.</span><br><span class="line">64 bytes from 172.17.0.2: icmp_seq=1 ttl=64 time=0.128 ms</span><br><span class="line">64 bytes from 172.17.0.2: icmp_seq=2 ttl=64 time=0.111 ms</span><br><span class="line">64 bytes from 172.17.0.2: icmp_seq=3 ttl=64 time=0.108 ms</span><br><span class="line">64 bytes from 172.17.0.2: icmp_seq=4 ttl=64 time=0.091 ms</span><br><span class="line"></span><br><span class="line">--- 172.17.0.2 ping statistics ---</span><br><span class="line">4 packets transmitted, 4 received, 0% packet loss, time 3001ms</span><br><span class="line">rtt min/avg/max/mdev = 0.091/0.109/0.128/0.016 ms</span><br></pre></td></tr></table></figure>

<ul>
<li>进入两个容器，检查容器互通情况</li>
</ul>
<p>由于是不同的网桥，因此不通。</p>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 进入容器c1，并ping容器c2</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it c1 sh</span></span><br><span class="line">/ # ifconfig eth0 </span><br><span class="line">eth0      Link encap:Ethernet  HWaddr 02:42:AC:11:00:02</span><br><span class="line">          inet addr:172.17.0.2  Bcast:172.17.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:14 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0</span><br><span class="line">          RX bytes:1132 (1.1 KiB)  TX bytes:476 (476.0 B)</span><br><span class="line">          </span><br><span class="line">/ # ping 172.18.0.2 -c 4     # 失败</span><br><span class="line">PING 172.18.0.2 (172.18.0.2): 56 data bytes</span><br><span class="line"></span><br><span class="line">--- 172.18.0.2 ping statistics ---</span><br><span class="line">4 packets transmitted, 0 packets received, 100% packet loss</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 进入容器c2，并ping容器c1</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it c2 sh</span></span><br><span class="line">/ # ifconfig eth0 </span><br><span class="line">eth0      Link encap:Ethernet  HWaddr 02:42:AC:12:00:02</span><br><span class="line">          inet addr:172.18.0.2  Bcast:172.18.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:14 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0</span><br><span class="line">          RX bytes:1132 (1.1 KiB)  TX bytes:476 (476.0 B)</span><br><span class="line"></span><br><span class="line">/ # ping 172.17.0.2 -c 4   # 失败</span><br><span class="line">PING 172.17.0.2 (172.17.0.2): 56 data bytes</span><br><span class="line"></span><br><span class="line">--- 172.17.0.2 ping statistics ---</span><br><span class="line">4 packets transmitted, 0 packets received, 100% packet loss</span><br></pre></td></tr></table></figure>

<ul>
<li>将容器c2连接到默认网桥上</li>
</ul>
<figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker network connect bridge c2  <span class="comment">## 默认网桥连接c2</span></span></span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">docker <span class="built_in">exec</span> -it c2 sh</span></span><br><span class="line">/ # ifconfig</span><br><span class="line">eth0      Link encap:Ethernet  HWaddr 02:42:AC:12:00:02</span><br><span class="line">          inet addr:172.18.0.2  Bcast:172.18.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:18 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:14 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0</span><br><span class="line">          RX bytes:1356 (1.3 KiB)  TX bytes:1092 (1.0 KiB)</span><br><span class="line"></span><br><span class="line">eth1      Link encap:Ethernet  HWaddr 02:42:AC:11:00:03  # 在c2中新增了一个默认网桥的IP地址</span><br><span class="line">          inet addr:172.17.0.3  Bcast:172.17.255.255  Mask:255.255.0.0</span><br><span class="line">          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1</span><br><span class="line">          RX packets:14 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:0</span><br><span class="line">          RX bytes:1132 (1.1 KiB)  TX bytes:476 (476.0 B)</span><br><span class="line"></span><br><span class="line">lo        Link encap:Local Loopback</span><br><span class="line">          inet addr:127.0.0.1  Mask:255.0.0.0</span><br><span class="line">          UP LOOPBACK RUNNING  MTU:65536  Metric:1</span><br><span class="line">          RX packets:0 errors:0 dropped:0 overruns:0 frame:0</span><br><span class="line">          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0</span><br><span class="line">          collisions:0 txqueuelen:1000</span><br><span class="line">          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)</span><br><span class="line">          </span><br><span class="line">/ # ping 172.17.0.2 -c 4</span><br><span class="line">PING 172.17.0.2 (172.17.0.2): 56 data bytes</span><br><span class="line">64 bytes from 172.17.0.2: seq=0 ttl=64 time=0.203 ms</span><br><span class="line">64 bytes from 172.17.0.2: seq=1 ttl=64 time=0.282 ms</span><br><span class="line">64 bytes from 172.17.0.2: seq=2 ttl=64 time=0.209 ms</span><br><span class="line">64 bytes from 172.17.0.2: seq=3 ttl=64 time=0.235 ms</span><br><span class="line"></span><br><span class="line">--- 172.17.0.2 ping statistics ---</span><br><span class="line">4 packets transmitted, 4 packets received, 0% packet loss</span><br><span class="line">round-trip min/avg/max = 0.203/0.232/0.282 ms</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_">#</span><span class="language-bash"><span class="comment"># 此时的宿主机网络如下</span></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">ip a</span></span><br><span class="line">1: lo: &lt;LOOPBACK,UP,LOWER_UP&gt; mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000</span><br><span class="line">    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00</span><br><span class="line">    inet 127.0.0.1/8 scope host lo</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 ::1/128 scope host</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">2: ens33: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc pfifo_fast state UP group default qlen 1000</span><br><span class="line">    link/ether 00:0c:29:54:e4:7e brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 10.138.3.130/24 brd 10.138.3.255 scope global noprefixroute ens33</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::9ecf:f41f:ee57:9f86/64 scope link noprefixroute</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">3: docker0: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default</span><br><span class="line">    link/ether 02:42:c2:92:b0:c7 brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.17.0.1/16 brd 172.17.255.255 scope global docker0</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:c2ff:fe92:b0c7/64 scope link</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">11: br-3733625e7c0b: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue state UP group default</span><br><span class="line">    link/ether 02:42:2a:ca:a0:0a brd ff:ff:ff:ff:ff:ff</span><br><span class="line">    inet 172.18.0.1/16 brd 172.18.255.255 scope global br-3733625e7c0b</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">    inet6 fe80::42:2aff:feca:a00a/64 scope link</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">29: vethecc9115@if28: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default</span><br><span class="line">    link/ether 0e:70:26:8e:d7:fa brd ff:ff:ff:ff:ff:ff link-netnsid 0</span><br><span class="line">    inet6 fe80::c70:26ff:fe8e:d7fa/64 scope link         # 默认网桥设备对1</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">31: veth863f55e@if30: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master br-3733625e7c0b state UP group default</span><br><span class="line">    link/ether 8e:3b:66:11:b6:39 brd ff:ff:ff:ff:ff:ff link-netnsid 1</span><br><span class="line">    inet6 fe80::8c3b:66ff:fe11:b639/64 scope link         # 新增网桥设备对</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line">33: veth61c962a@if32: &lt;BROADCAST,MULTICAST,UP,LOWER_UP&gt; mtu 1500 qdisc noqueue master docker0 state UP group default</span><br><span class="line">    link/ether 66:4a:c4:81:14:05 brd ff:ff:ff:ff:ff:ff link-netnsid 1</span><br><span class="line">    inet6 fe80::644a:c4ff:fe81:1405/64 scope link        # 默认网桥设备对2，新增的对应172.0.0.3</span><br><span class="line">       valid_lft forever preferred_lft forever</span><br><span class="line"><span class="meta prompt_"></span></span><br><span class="line"><span class="meta prompt_"># </span><span class="language-bash">brctl  show</span></span><br><span class="line">bridge name     bridge id               STP enabled     interfaces</span><br><span class="line">br-3733625e7c0b         8000.02422acaa00a       no              veth863f55e</span><br><span class="line">docker0         8000.0242c292b0c7       no              veth61c962a  ## 默认网桥新增了一个接口</span><br><span class="line">                                                        vethecc9115</span><br></pre></td></tr></table></figure>
</article><div class="post-copyright"><div class="post-copyright__author"><span class="post-copyright-meta">文章作者: </span><span class="post-copyright-info"><a href="https://rushiy.gitee.io">rushiy</a></span></div><div class="post-copyright__type"><span class="post-copyright-meta">文章链接: </span><span class="post-copyright-info"><a href="https://rushiy.gitee.io/docker/docker%E5%AE%B9%E5%99%A8%E7%BD%91%E7%BB%9C/">https://rushiy.gitee.io/docker/docker%E5%AE%B9%E5%99%A8%E7%BD%91%E7%BB%9C/</a></span></div><div class="post-copyright__notice"><span class="post-copyright-meta">版权声明: </span><span class="post-copyright-info">本博客所有文章除特别声明外，均采用 <a href="https://creativecommons.org/licenses/by-nc-sa/4.0/" target="_blank">CC BY-NC-SA 4.0</a> 许可协议。转载请注明来自 <a href="https://rushiy.gitee.io" target="_blank">如是的学习博客</a>！</span></div></div><div class="tag_share"><div class="post-meta__tag-list"><a class="post-meta__tags" href="/tags/docker/">docker</a></div><div class="post_share"><div class="social-share" data-image="" data-sites="wechat,weibo,qq"></div><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/butterfly-extsrc/sharejs/dist/css/share.min.css" media="print" onload="this.media='all'"><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc/sharejs/dist/js/social-share.min.js" defer></script></div></div></div><div class="aside-content" id="aside-content"><div class="card-widget card-info"><div class="is-center"><div class="avatar-img"><img src="/img/favicon.jpg" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/></div><div class="author-info__name">rushiy</div><div class="author-info__description"></div></div><div class="card-info-data site-data is-center"><a href="/archives/"><div class="headline">文章</div><div class="length-num">28</div></a><a href="/tags/"><div class="headline">标签</div><div class="length-num">3</div></a><a href="/categories/"><div class="headline">分类</div><div class="length-num">0</div></a></div><div class="card-info-social-icons is-center"><a class="social-icon" href="mailto:rushiy@reg.email.cn" target="_blank" title="Email"><i class="fas fa-envelope"></i></a></div></div><div class="sticky_layout"><div class="card-widget" id="card-toc"><div class="item-headline"><i class="fas fa-stream"></i><span>目录</span><span class="toc-percentage"></span></div><div class="toc-content"><ol class="toc"><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%9B%9B%E7%B1%BB%E7%BD%91%E7%BB%9C%E6%A8%A1%E5%BC%8F"><span class="toc-number">1.</span> <span class="toc-text">四类网络模式</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#host%E6%A8%A1%E5%BC%8F"><span class="toc-number">1.1.</span> <span class="toc-text">host模式</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#container%E6%A8%A1%E5%BC%8F"><span class="toc-number">1.2.</span> <span class="toc-text">container模式</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#none%E6%A8%A1%E5%BC%8F"><span class="toc-number">1.3.</span> <span class="toc-text">none模式</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#bridge%E6%A8%A1%E5%BC%8F-%E9%BB%98%E8%AE%A4%E6%A8%A1%E5%BC%8F"><span class="toc-number">1.4.</span> <span class="toc-text">bridge模式(默认模式)</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E6%A1%A5%E6%8E%A5%E6%A8%A1%E5%BC%8F%E4%B8%8B%E6%9A%B4%E9%9C%B2%E7%AB%AF%E5%8F%A3"><span class="toc-number">2.</span> <span class="toc-text">桥接模式下暴露端口</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%9A%B4%E9%9C%B2%E9%9A%8F%E6%9C%BA%E7%AB%AF%E5%8F%A3"><span class="toc-number">2.1.</span> <span class="toc-text">暴露随机端口</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%9A%B4%E9%9C%B2%E6%8C%87%E5%AE%9A%E7%AB%AF%E5%8F%A3"><span class="toc-number">2.2.</span> <span class="toc-text">暴露指定端口</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E8%B7%A8%E4%B8%BB%E6%9C%BA%E9%97%B4%E7%9A%84docker%E7%BD%91%E7%BB%9C%EF%BC%9Amacvlan"><span class="toc-number">3.</span> <span class="toc-text">跨主机间的docker网络：macvlan</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%96%B0%E5%BB%BAmacvlan%E7%B1%BB%E5%9E%8B%E7%9A%84%E7%BD%91%E7%BB%9C"><span class="toc-number">3.1.</span> <span class="toc-text">新建macvlan类型的网络</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E4%BD%BF%E7%94%A8macvlan%E7%B1%BB%E5%9E%8B%E7%BD%91%E7%BB%9C%E5%88%9B%E5%BB%BA%E7%9A%84%E5%AE%B9%E5%99%A8"><span class="toc-number">3.2.</span> <span class="toc-text">使用macvlan类型网络创建的容器</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%90%8C%E4%B8%80%E4%B8%AA%E9%A1%B9%E7%9B%AE%E4%B8%AD%E7%9A%84%E5%AE%B9%E5%99%A8%E9%80%9A%E4%BF%A1%E7%9A%84%E5%B8%B8%E8%A7%84%E5%81%9A%E6%B3%95"><span class="toc-number">4.</span> <span class="toc-text">同一个项目中的容器通信的常规做法</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E9%BB%98%E8%AE%A4%E7%BD%91%E6%A1%A5%EF%BC%9A%E5%8F%AF%E9%80%9A%E8%BF%87ip%E9%80%9A%E4%BF%A1%EF%BC%8C%E4%B8%8D%E5%8F%AF%E9%80%9A%E8%BF%87%E4%B8%BB%E6%9C%BA%E5%90%8D%E9%80%9A%E4%BF%A1"><span class="toc-number">4.1.</span> <span class="toc-text">默认网桥：可通过ip通信，不可通过主机名通信</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E6%96%B0%E5%BB%BA%E7%BD%91%E6%A1%A5%EF%BC%9A%E5%8F%AF%E9%80%9A%E8%BF%87%E4%B8%BB%E6%9C%BA%E5%90%8D%E5%92%8CIP%E9%80%9A%E4%BF%A1"><span class="toc-number">4.2.</span> <span class="toc-text">新建网桥：可通过主机名和IP通信</span></a></li></ol></li><li class="toc-item toc-level-2"><a class="toc-link" href="#%E5%87%A0%E4%B8%AA%E5%B8%B8%E8%A7%81%E7%9A%84docker%E7%BD%91%E7%BB%9C%E9%97%AE%E9%A2%98"><span class="toc-number">5.</span> <span class="toc-text">几个常见的docker网络问题</span></a><ol class="toc-child"><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AE%89%E8%A3%85dockers%E5%92%8C%E5%90%AF%E5%8A%A8%E5%AE%B9%E5%99%A8%E5%89%8D%E5%90%8E%E7%BD%91%E7%BB%9C%E5%8F%98%E5%8C%96"><span class="toc-number">5.1.</span> <span class="toc-text">安装dockers和启动容器前后网络变化</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%AE%89%E8%A3%85%E5%92%8C%E5%90%AF%E5%8A%A8docker%E5%89%8D%E5%90%8E"><span class="toc-number">5.1.1.</span> <span class="toc-text">安装和启动docker前后</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#%E5%90%AF%E5%8A%A8%E5%AE%B9%E5%99%A8%E5%90%8E"><span class="toc-number">5.1.2.</span> <span class="toc-text">启动容器后</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%90%8C%E5%8F%B0%E5%AE%BF%E4%B8%BB%E6%9C%BA%E4%B8%8A%E4%B8%A4%E4%B8%AA%E5%AE%B9%E5%99%A8%E7%9A%84%E6%95%B0%E6%8D%AE%E5%8C%85%E8%B5%B0%E5%90%91"><span class="toc-number">5.2.</span> <span class="toc-text">同台宿主机上两个容器的数据包走向</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AE%B9%E5%99%A8%E8%BF%9E%E6%8E%A5%E5%A4%96%E7%BD%91%E6%97%B6%E7%9A%84%E6%95%B0%E6%8D%AE%E5%8C%85%E8%B5%B0%E5%90%91%EF%BC%9A%E6%BA%90%E5%9C%B0%E5%9D%80%E8%BD%AC%E6%8D%A2"><span class="toc-number">5.3.</span> <span class="toc-text">容器连接外网时的数据包走向：源地址转换</span></a><ol class="toc-child"><li class="toc-item toc-level-4"><a class="toc-link" href="#%E6%95%B0%E6%8D%AE%E5%8C%85%E6%B5%81%E5%87%BA-request-%E6%83%85%E5%86%B5"><span class="toc-number">5.3.1.</span> <span class="toc-text">数据包流出(request)情况</span></a></li><li class="toc-item toc-level-4"><a class="toc-link" href="#5-3-2-%E6%95%B0%E6%8D%AE%E5%8C%85%E6%B5%81%E5%85%A5-reply-%E6%83%85%E5%86%B5"><span class="toc-number">5.3.2.</span> <span class="toc-text">5.3.2 数据包流入(reply)情况</span></a></li></ol></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AE%B9%E5%99%A8%E8%BF%9E%E6%8E%A5%E5%A4%96%E7%BD%91%E6%97%B6%E7%9A%84%E6%95%B0%E6%8D%AE%E5%8C%85%E8%B5%B0%E5%90%91%EF%BC%9A%E7%9B%AE%E6%A0%87%E5%9C%B0%E5%9D%80%E8%BD%AC%E6%8D%A2"><span class="toc-number">5.4.</span> <span class="toc-text">容器连接外网时的数据包走向：目标地址转换</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%AE%B9%E5%99%A82%E5%BC%95%E7%94%A8%E5%AE%B9%E5%99%A81%E7%9A%84%E7%BD%91%E7%BB%9C%EF%BC%8C%E5%BD%93%E5%AE%B9%E5%99%A81%E5%AE%95%E6%8E%89%E5%90%8E%EF%BC%8C%E5%AE%B9%E5%99%A82%E7%9A%84%E7%BD%91%E7%BB%9C%E8%BF%98%E8%83%BD%E6%AD%A3%E5%B8%B8%E5%90%97%EF%BC%9F"><span class="toc-number">5.5.</span> <span class="toc-text">容器2引用容器1的网络，当容器1宕掉后，容器2的网络还能正常吗？</span></a></li><li class="toc-item toc-level-3"><a class="toc-link" href="#%E5%90%8C%E5%8F%B0%E5%AE%BF%E4%B8%BB%E6%9C%BA%EF%BC%8C%E4%B8%8D%E5%90%8C%E7%BD%91%E6%A1%A5%E4%B8%8A%E7%9A%84%E4%B8%A4%E4%B8%AA%E5%AE%B9%E5%99%A8%E7%9A%84%E4%BA%92%E9%80%9A"><span class="toc-number">5.6.</span> <span class="toc-text">同台宿主机，不同网桥上的两个容器的互通</span></a></li></ol></li></ol></div></div><div class="card-widget card-recent-post"><div class="item-headline"><i class="fas fa-history"></i><span>最新文章</span></div><div class="aside-list"><div class="aside-list-item"><a class="thumbnail" href="/django/Django%E6%A8%A1%E6%9D%BF%E7%B3%BB%E7%BB%9F/" title="Django模板系统"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Django模板系统"/></a><div class="content"><a class="title" href="/django/Django%E6%A8%A1%E6%9D%BF%E7%B3%BB%E7%BB%9F/" title="Django模板系统">Django模板系统</a><time datetime="2022-11-04T07:08:03.000Z" title="发表于 2022-11-04 15:08:03">2022-11-04</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/django/Django%E8%A7%86%E5%9B%BE/" title="Django视图"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Django视图"/></a><div class="content"><a class="title" href="/django/Django%E8%A7%86%E5%9B%BE/" title="Django视图">Django视图</a><time datetime="2022-11-03T07:07:51.000Z" title="发表于 2022-11-03 15:07:51">2022-11-03</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/django/Django%E8%B7%AF%E7%94%B1%E7%B3%BB%E7%BB%9F/" title="Django路由系统"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Django路由系统"/></a><div class="content"><a class="title" href="/django/Django%E8%B7%AF%E7%94%B1%E7%B3%BB%E7%BB%9F/" title="Django路由系统">Django路由系统</a><time datetime="2022-11-02T07:07:34.000Z" title="发表于 2022-11-02 15:07:34">2022-11-02</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/django/%E8%B5%B0%E8%BF%9BDjango/" title="走进Django"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="走进Django"/></a><div class="content"><a class="title" href="/django/%E8%B5%B0%E8%BF%9BDjango/" title="走进Django">走进Django</a><time datetime="2022-11-01T07:01:20.000Z" title="发表于 2022-11-01 15:01:20">2022-11-01</time></div></div><div class="aside-list-item"><a class="thumbnail" href="/python/python%E5%B8%B8%E7%94%A8%E6%A8%A1%E5%9D%97/" title="python常用模块"><img src="" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="python常用模块"/></a><div class="content"><a class="title" href="/python/python%E5%B8%B8%E7%94%A8%E6%A8%A1%E5%9D%97/" title="python常用模块">python常用模块</a><time datetime="2022-10-28T15:34:07.000Z" title="发表于 2022-10-28 23:34:07">2022-10-28</time></div></div></div></div></div></div></main><footer id="footer"><div id="footer-wrap"><div class="copyright">&copy;2022 By rushiy</div><div class="framework-info"><span>框架 </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>主题 </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="readmode" type="button" title="阅读模式"><i class="fas fa-book-open"></i></button><button id="darkmode" type="button" title="浅色和深色模式转换"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="单栏和双栏切换"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside_config" type="button" title="设置"><i class="fas fa-cog fa-spin"></i></button><button class="close" id="mobile-toc-button" type="button" title="目录"><i class="fas fa-list-ul"></i></button><button id="go-up" type="button" title="回到顶部"><i class="fas fa-arrow-up"></i></button></div></div><div><script src="/js/utils.js"></script><script src="/js/main.js"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui/dist/fancybox.umd.min.js"></script><div class="js-pjax"></div><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc/dist/activate-power-mode.min.js"></script><script>POWERMODE.colorful = true;
POWERMODE.shake = true;
POWERMODE.mobile = false;
document.body.addEventListener('input', POWERMODE);
</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script></div></body></html>